Criteo S.A. 10-K

Item 1A Risk Factors Investing in our ADSs involves a high degree of risk. You should carefully consider the following risks and all other information contained in this Form 10-K, including our consolidated financial statements and the related notes thereto, before investing in our ADSs. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. If any of the following risks materialize, our business, financial condition and results of operations could be materially harmed. In that case, the trading price of our ADSs could decline, and you may lose some or all your investment. Risks Related to Our Business and Industry If we fail to innovate, enhance our brand, and adapt and respond effectively to rapidly changing technology, our offerings may become less competitive or obsolete. Our investments in new solutions and technologies to address new marketing goals for our clients are inherently risky and may not be successful. Our industry and business are subject to rapid and frequent changes in technology, evolving client needs and the frequent introduction by our competitors of new and enhanced offerings. Our future success will depend on our ability to continuously enhance and improve our offerings to meet client needs, build our brand, scale our technology capabilities, add functionality to and improve the performance of the Criteo Commerce Media Platform, and address technological and industry advancements. If we are unable to enhance our solutions to meet market demand in a timely manner, we may not be able to maintain our existing clients or attract new clients, and our solutions may become less competitive or obsolete. Furthermore, brand promotion activities may not yield increased revenue sufficient to offset expenses or any increased revenue at all. Our investments in our Commerce Media Platform and new technologies are inherently risky and may not be successful. While we have a track record of addressing broader marketing and monetization goals, including customer acquisition and brand awareness, we continue to invest substantial resources to adapt our model, pricing and organization to expand into new advertising channels. If we are not successful in continuing to improve and adapt our solutions along broader marketing goals, our results of operations could be adversely affected. Furthermore, we believe that the importance of brand recognition will increase as competition in our market increases. The market in which we participate is intensely competitive, and we may not be able to compete successfully with our current or future competitors. The market for digital advertising solutions, including specifically retail media, is highly competitive and rapidly changing, as market participants develop new technologies and offer multiple new products and services aimed at facilitating and/or capturing advertising spend. With the introduction of new technologies and the influx of new entrants to the market, including large established companies, smaller companies that we do not yet know about, or companies that do not yet exist, we expect competition to persist and intensify in the future, which could harm our ability to increase sales and maintain our profitability, including if competition increases pricing pressure. Certain internet and technology companies may have the power and capital to significantly change the very nature of the digital advertising marketplaces in ways that could materially disadvantage us. Some of these companies could leverage their positions to make changes to their web browsers, mobile operating systems, platforms, exchanges, networks or other solutions or services that could be significantly harmful to our business and results of operations. Some of these companies also have significantly larger resources and capital than we do, and in many cases have advantageous competitive positions in popular products and services such as Amazon Advertising, Google Search, YouTube, Chrome, Meta Platforms, and Apple Search Ads , which they can use to their advantage. Furthermore, our competitors have invested substantial resources and capital in innovation, which could lead to technological advancements that change the competitive dynamics of our business in ways that we may not be able to predict. In addition to competing for advertising spend, we compete with many companies for advertising inventory, some of whom also operate their own advertising networks or exchanges from which we buy advertising inventory. 17 As more companies compete for advertising impressions on advertising exchange platforms and other platforms that aggregate supply of advertising inventory, advertising inventory may become competitive and expensive, which may adversely affect our ability to acquire a consistent supply of advertising inventory and to deliver advertisements on a profitable basis. Some of the companies that we compete with, either for advertising spend or inventory, may also be our clients or affiliated with our clients or important sources of advertising inventory. Competitive pressure may incentivize such companies to cease to be our clients or cease to provide us with access to their advertising inventory. If this were to occur, our ability to place advertisements would be significantly impaired and our results of operations would be adversely affected. Some large retailers, which could include our own clients, may develop retail media advertising technologies in-house, and may move some of their demand to a direct sales model such that they would do some of their own sales. Competition could also hinder the success of new advertising solutions that we offer in the future. If any of these risks were to materialize, our ability to compete effectively could be significantly compromised and our results of operations could be harmed. Any of these developments would make it more difficult for us to sell our offerings and could result in increased pricing pressure, reduced fees and gross margins, increased sales and marketing expense and/or the loss of market share. Our success depends on our ability to implement our business transformation and achieve our global business strategies. Our business has recently undergone, and continues to undergo, a significant transformation, partially in response to major changes in the advertising technology industry driven by, but not limited to, regulations such as GDPR and restrictions on data collection and use, including those implemented by large technology companies. The components of our transformation include diversification of our services as we rely less on third-party signals, focus on growth and investment, and certain organization adjustments and cost optimization opportunities. Our future performance and growth depend on the success of this transformation and our new business strategies, including our management team’s ability to successfully implement them. Our ongoing transformation has resulted, and may continue to result, in changes to business priorities and operations, capital allocation priorities, operational and organizational structure, and increased demands on management. Such changes could result in short-term and one-time costs, lost clients, reduced sales volume, higher than expected restructuring costs, productivity or retention issues, business disruption, and other negative impacts on our business. As we continue to transform our business, we may not realize the anticipated benefits or the realization of such benefits may be delayed. The failure to realize benefits or savings, which may be due to our inability to execute plans, delays in the implementation of continued transformation and growth and our product roadmap, global or local economic conditions, competition, changes in the advertising technology industry and the other risks described herein, could have a material adverse effect on our business, financial condition and results of operations, as well as the trading price of our securities. The failure by Criteo AI Engine to accurately predict user engagement and the failure to maintain the quality of our client and publisher content could result in significant costs to us, lost revenue and diminished business opportunities. The effective delivery of certain of our digital advertising solutions relies in part on the ability of Criteo AI Engine to predict the likelihood that a consumer will engage with any given internet display advertisement with a sufficient degree of accuracy so that our clients can achieve desirable returns on their advertising spend. Although we have evolved our pricing models alongside our broader suite of solutions, a large part of our revenue continues to be generated through click or impression based pricing models or an equivalent, such that our clients only pay us when a user engages with the advertisement, usually by clicking on it. Many of our agreements with clients do not include a spending minimum. Similarly, our contracts with publishers generally do not include long-term obligations requiring them to make their inventory available to us over long periods of time. Therefore, we need to continuously deliver satisfactory results for our clients and publishers to maintain and increase revenue, which depends partly on the optimal functioning of Criteo AI Engine. In addition, we have seen significant growth in the amount and complexity of data processed by Criteo AI Engine and the number of advertising impressions we deliver. As the amount of data and number of variables processed by Criteo AI Engine increase, and the calculations that the algorithms must compute become increasingly complex, the risk of errors in the type of data collected, stored, generated or accessed also increases. 18 Our client’s satisfaction also depends on our ability to keep advertisements from being placed in unlawful or inappropriate content, or content that is not permitted under the terms of the applicable agreements with clients. While this depends in part on the optimal functioning of the Criteo AI Engine, as more of our clients use our self-service tools with less intervention by us, it could become more challenging to train and support such clients to use such tools and to prevent inappropriate or unlawful advertisements from being shown. Consistent with the nature of all technology companies, fraudulent or malicious activity, including non-human traffic, could also impair the proper functioning of Criteo AI Engine. For example, the use of bots or other automated or manual mechanisms to generate fraudulent clicks or misattribute clicks on advertisements we deliver could overstate the performance of our advertising. Due to the higher cost per 1,000 impressions paid for online video and Connected TV advertisements, the risk of fraudulent traffic may increase as we increase our purchasing of online video and Connected TV inventory. If we were to experience significant errors, defects, or fraudulent or malicious activity in Criteo AI Engine, our solution could be impaired or stop working altogether, which could significantly impair our ability to purchase any advertising inventory and generate any revenue until the errors, defects or fraudulent or malicious activity were detected and corrected. If we are unable to keep our clients’ advertisements from being placed in unlawful or inappropriate content, our reputation and business may suffer. Other negative consequences from experiencing such issues could include: • a loss of clients and publishers or a decrease in inventory purchased by clients; • fewer consumer visits to our client websites or mobile applications; • faulty inventory purchase decisions, resulting in lower profitability per impression, up to and including negative margins , for which we may need to bear the cost; • lower return on advertising spend for our clients; • lower price for the advertising inventory we can offer to publishers; • delivery of less relevant or irrelevant advertisements, resulting in lower click-through or conversion rates; • being blocked by internet service providers or regulators; • refusals to pay, demands for refunds, loss of confidence, termination of campaigns or withdrawal of future business and potential liability for damages or regulatory inquiries or lawsuits; and • negative publicity or harm to our reputation. As a result, the failure by Criteo AI Engine to accurately predict engagement of users and the failure to maintain the quality of our client and publisher content could result in significant costs, lost revenue and diminished business opportunities. Third parties may implement technical restrictions that impede our access to data and revenue opportunities upon which we rely, which could materially impact our business and results of operations. A substantial portion of the data we rely on comes from our publisher and retailer partners and other third parties, including advertising exchange platforms (including supply-side platforms, or “SSPs”, such as Google’s Ad Manager) and retailers. Similarly, we rely on our publisher and retailer partners, and such other third parties for opportunities to serve advertisements through which we generate our revenue. Our ability to successfully leverage such data and successfully generate revenue from such opportunities could be impacted by restrictions imposed by or on our publisher and retailer partners or other third parties, including restrictions on our ability to use or read cookies or other tracking features or our ability to use real-time bidding networks or other bidding networks. For example, our publishers and retailer partners are responsible under European regulation, such as the GDPR, the E- Privacy Directive (each as defined below) and other new government restrictions, for gathering necessary user consents and indicating to SSPs that Criteo has been approved by the applicable users. As part of their efforts to comply with their understanding of the requirements of European regulation, certain SSPs have required actions from publishers and retailer partners with respect to such consents that appear stricter than regulations require. Similarly, SSPs and other relevant third parties may take similar actions in response to any new legislation or regulatory developments or interpretations in the future, in response to perceived user preferences, or for other reasons. If third parties on which we rely for data or opportunities to serve advertisements impose similar restrictions or are not able to comply with restrictions imposed by other ecosystem participants, we may lose the ability to access data, bid on opportunities, or purchase digital ad space, which could have a substantial impact on our revenue. 19 We have substantial client concentration in certain markets and solutions, with a limited number of clients accounting for a substantial portion of our revenues in those areas. Although our overall customer base is well-diversified, with our largest 10 clients representing 17.1% of our revenue i n the aggregate in 2024 , in certain of our markets and solutions we derive a substantial portion of revenues from a limited number of clients. We cannot predict the future level of demand for our services and products generated by these clients, and revenues from these clients may fluctuate. Further, some of our contracts with these clients may permit them to terminate or reduce use of our products at any time (subject to notice and certain other provisions). If we fail to retain any of these clients or any of these clients terminate or reduce use of our products, if not replaced by new clients and an increase in business from existing clients, our revenues within certain markets or solutions may be negatively impacted. We may not be able to effectively integrate or realize the expected benefits of acquisitions or strategic transactions, which may adversely affect our ability to achieve our growth and business objectives. We explore, on an ongoing basis, potential acquisitions of additional businesses, products, solutions, technologies or teams, and other potential strategic transactions, including investments and partnerships. If we pursue any such strategic transaction, we may not be successful in negotiating the terms and/or financing of the transaction, and our due diligence may fail to identify all of the problems, contingencies, liabilities or other shortcomings or challenges of the relevant market, business, product, solution or technology. Any strategic transaction may require us to use significant amounts of cash, incur debt, issue potentially dilutive equity securities or incur contingent liabilities or amortization of expenses, or impairment of goodwill and/or purchased long-lived assets, and restructuring charges, any of which could harm our financial condition or results. The Company has incurred and will incur significant transaction and acquisition-related costs in connection with its acquisitions or other transactions, including legal, accounting, financial advisory, regulatory and other expenses. The payment of such transaction costs could adversely effect our financial condition, results of operations or cash flows. In addition, the anticipated benefits of any acquisition or investment may not be realized, and we may be exposed to unknown risks, which could adversely affect our business, financial condition or operating results, including risks arising from: • difficulties in integrating the operations, technologies, services and personnel of acquired businesses, especially if those businesses operate outside of our core competency and across different geographies; • ineffectiveness, lack of scalability, or incompatibility of acquired technologies or services; • unforeseen cybersecurity issues or flaws in acquired technologies or the integration thereof; • loss of key employees of acquired businesses; • inability to maintain the key business relationships and the reputation of acquired businesses or products; • failure to successfully further develop the acquired technology to recoup our investment; • diverting management’s attention from other business concerns; • liability or litigation for activities of the acquired business, including claims from terminated employees, clients, former shareholders or other third parties; • implementation or remediation of controls, practices, procedures and policies at acquired businesses, including the costs necessary to establish and maintain effective internal controls; and • increased fixed costs without corresponding offsetting growth. Our international operations and expansion expose us to several risks. As of December 31, 2024 , we had a direct operating pres ence in 23 offices and shared workplaces located in 16 countries and did business in 108 countries . Our current global operations and future initiatives involve a variety of risks, including: • operational and execution risk, including localization of the product interface and systems, translation into foreign languages, adaptation for local practices, adequate coordination to onboard local clients and publishers, difficulty of maintaining our corporate culture, challenges inherent to hiring and efficiently managing employees over large geographic distances, and the increasing complexity of the organizational structure required to support expansion and operations into multiple geographies and regulatory systems; • insufficient, or insufficiently coordinated, demand for and supply of advertising inventory in specific geographic markets processed through Criteo AI Engine, which could impair its ability to accurately predict user engagement in that market; • compliance with (and liability for failure to comply with) applicable local laws and regulations, including, among other things, laws and regulations with respect to data protection and user privacy, data use, tax and withholding, labor regulations, anti-corruption, environment, consumer protection, economic sanctions, public health crises (including the outbreak of contagious disease and pandemics), spam and content, and AI, which laws and regulations may be inconsistent across jurisdictions; • intensity of local competition for digital advertising budgets and internet advertising inventory; 20 • changes in a specific country’s or region’s political or economic conditions, including through elections; • risks related to tariffs and trade barriers, pricing structure, payment and currency, including aligning our pricing model and payment terms with local norms, higher levels of credit risk and payment fraud, difficulties in invoicing and collecting in foreign currencies and associated foreign currency exposure, restrictions on foreign ownership and investments, and difficulties in repatriating or transferring funds from or converting currencies; an d • limited or unfavorable intellectual property (“IP”) protection; Additionally, operating in international markets also requires significant management attention and financial and legal resources. We cannot be certain that the investment and additional resources required in establishing operations in other countries will produce desired levels of revenue or profitability. Because Criteo S.A.'s functional currency is the euro, while Criteo S.A.'s reporting currency is the U.S. dollar, we face exposure to fluctuations in foreign currency exchange rates. Foreign currency exchange risk exposure also arises from intra-company transactions and financing with subsidiaries that have a functional currency different than the euro. While we are engaging in hedging transactions to minimize the impact of uncertainty in future exchange rates on intra- company transactions and financing, we may not hedge all of our foreign currency exchange rate risk. In addition, hedging transactions carry their own risks and costs, and could expose us to additional risks that could harm our financial condition and operating results. Regulatory, legislative or self-regulatory developments regarding internet or online matters could adversely affect our ability to conduct our business. Governmental authorities around the world have enacted, considered or are considering legislation or regulations that could significantly restrict our ability to collect, process, use, transfer and pool data collected from and about consumers and devices. Trade associations and industry self-regulatory groups have also promulgated best practices and other industry standards relating to targeted advertising. In the European Union (“EU”), the two main pillars of the data protection legal framework are the Directive on Privacy and Electronic Communications (“E-Privacy Directive”) and the General Data Protection Regulation (“GDPR”). The E-Privacy Directive directs EU member states to ensure that accessing information on an Internet user’s computer, such as through a cookie and other similar technologies, is allowed only if the Internet user has been informed about such access and given consent. The Court of Justice of the EU clarified that such consent must be reflected by an affirmative act of the user in line with the requirements applicable to consent under GDPR. These developments result in ending reliance on implied consent mechanisms used to meet requirements of the E-Privacy Directive in some markets. The European Data Protection Board has also published guidelines further restricting its interpretation of the technical scope of the E-Privacy Directive, increasingly limiting our possibility to rely on certain tracking technologies such as racking links and URL. Under GDPR, data protection authorities have the power to impose administrative fines of up to a maximum of €20 million or 4% of the data controller’s or data processor’s total worldwide turnover from the preceding financial year. Similar sanctions would be applicable under the E-Privacy Regulation to cookie consent. Further, on October 1, 2020, the French data protection authority (the Commission Nationale de l'Informatique et des Libertés , or the “CNIL”) issued the final version of its guidelines on the use of cookies and other trackers and its final recommendations on modalities for obtaining users’ consent to store or read non-essential cookies and similar technologies on their devices. The recommendations provide that, when required, consent must be indicated by a clear and positive action of the data subject, such as by clicking on an “accept all” button on the first layer of the consent management platform. The CNIL also noted that it should be as easy to refuse consent to the use of cookies as it is to accept consent, and an equivalent “refuse all” button should be present on the first layer of the consent management platform. Further, the ability to withdraw consent must be always readily available. Companies had until March 2021 to ensure compliance with these guidelines. The CNIL has launched investigations and sanctioned companies for lack of compliance with its guidelines on cookies. The European Center for Digital Rights (“NOYB”) has also filed several complaints with data protection authorities for failure to comply with GDPR requirements. In January 2020, the CNIL opened a formal investigation into Criteo. In June 2023, the CNIL issued its decision, which retained alleged GDPR violations but reduced the financial sanction against Criteo from the original amount of €60.0 million ($65.0 million) to €40.0 million ($44.0 million). Criteo made the required sanction payment in the third quarter of 2023. The decision relates to past matters and does not include any obligation for Criteo to change its current practices. Criteo has appealed this decision before the Conseil d’Etat . Refer to Note 20. Commitments and Contingencies for more information. 21 In 2018, the State of California adopted the California Consumer Privacy Act of 2018 (the “CCPA”), which went into effect on January 1, 2020, and requires covered companies to, among other things, provide new disclosures to California consumers and afford such consumers new abilities to opt out of the sale of their personal information. In November 2020, voters in California passed the California Privacy Rights Act (“CPRA”), which both amends and expands the scope of the CCPA. The CPRA, which became effective on January 1, 2023, created additional privacy rights and protections for California consumers with respect to their personal information and additional obligations on businesses. We cannot predict the full effect of these laws and regulations on our business, but adapting our business to comply with them could involve substantial resources and expense, and may cause us to divert resources from other aspects of our business, all of which may adversely affect our business. In addition, other states in the U.S. are quickly adopting state enacted privacy laws. Currently, a total of 20 states in the U.S have passed consumer and privacy laws. Of those 20, eight state’s laws are currently effective. Some of these consumer and privacy laws differ slightly from the CCPA and CPRA leading to a varied and complex regulatory landscape, which could result in material costs. Clarifications of and changes to these existing and proposed laws, regulations, judicial interpretations and industry standards can be costly to comply with, and sometimes contradictory, and we may be unable to pass along those costs to our clients in the form of increased fees, which may negatively affect our operating results. Such changes can also delay or impede the development of new solutions, result in negative publicity and reputational harm, require significant management time and attention, increase our risk of non-compliance and subject us to claims or other remedies, including fines or demands that we modify or cease existing business practices. Additionally, any perception of our practices or solutions as an invasion of privacy, whether such practices or solutions are consistent with current or future regulations and industry practices, may subject us to public criticism, private class actions, reputational harm or claims by regulators, which could disrupt our business and expose us to increased liability. Finally, our legal and financial exposure often depends in part on our clients’, publisher and retailer partners’ or other third parties' adherence to and compliance with privacy laws and regulations and their use of our services in ways consistent with users’ expectations. If our clients or publisher and retail partners fail to adhere to our contracts in this regard, or a court or governmental agency determines that we have not adequately, accurately or completely described our own solutions, services and data collection, use and sharing practices in our own disclosures to consumers, then we and our clients and publisher and retailer partners may be subject to potentially adverse publicity, damages and investigation or other regulatory activity in connection with our privacy practices or those of our clients. Additionally, legislative and regulatory action is emerging in the areas of artificial intelligence (“AI”), which, given our long history developing using and innovating through AI with the Criteo AI Engine, could increase costs or restrict opportunity. Compliance with existing, expanding, or new laws and regulations regarding AI or use of data to train AI, including the EU AI Act adopted on July 12, 2024 and other data protection laws, may involve significant costs or require changes in products or business practices that could adversely affect our results of operations. Additionally, our ability to innovate may be affected if we are unable to access foundation models and general- purpose AI in the same manner as our non- EU competitors. Our ability to generate revenue depends on our collection of significant amounts of data from various sources, which may be restricted by consumer choice, clients, publishers and retailer partners, browsers or other software, changes in technology, and new developments in laws, regulations and industry standards. Our ability to optimize the delivery of internet advertisements for our clients depends on our ability to successfully leverage data, including data that we collect from our clients, data we receive from our publisher partners, retailers and third parties, and data from our own operating history. Using cookies and other tracking technologies, such as hashed emails, hashed customer log-ins, hashed mobile phone numbers or mobile advertising identifiers, we collect information about the interactions of users with our clients’ and publisher and retailer partners’ digital properties (including, for example, information about the placement of advertisements and users’ shopping or other interactions with our clients’ websites or advertisements). Our ability to successfully leverage such data depends on our continued ability to access and use such data, which could be restricted by a number of factors, including consumer choices, restrictions imposed by counterparties (such as clients, supply sources and publisher and retailer partners, who may also compete with us for advertising spend and inventory), web browser developers or other software developers, changes in technology, including changes in web browser technology, increased visibility of consent or “do not track” mechanisms or “ad-blocking” software, the emergence of new opt-out signals such as “Global Privacy Control” and “Global Privacy Platform”, and new developments in, or new interpretations of, laws, regulations and industry standards. These types of restrictions could materially impair the results of our operations. 22 Web browser developers, such as Apple, Mozilla Foundation, Microsoft or Google, have implemented or may implement changes in browser or device functionality that impair our ability to understand the preferences of consumers, including by limiting the use of third-party cookies or other tracking technologies or data indicating or predicting consumer preferences. Today, several major web browsers block third-party cookies by default. Internet users can also delete cookies from their computers and mobile devices at any time. In July 2024, following the investigation of the UK Competition and Market Authority (“CMA”), Google announced that it had abandoned plans to phase out support for third-party cookies in Chrome. Instead of deprecating third-party cookies, Google has proposed an updated framework that allows users to make an informed choice across web browsing that can be adjusted any time, which proposal remains subject to consultation with the CMA, the Information Commissioner’s Office and other global regulators. Google also confirmed that it will pursue the development and rollout of its Privacy Sandbox initiative (“PSB”) in parallel with this updated choice framework. Google’s PSB would limit certain processing of personal data through third-party cookies, and replace it with certain application programming interfaces (“APIs”) that would allow advertisers to receive data without using such third-party cookies. If the updated choice framework and the PSB are adopted, it could require us to make changes to how we collect information on consumer preferences. Google controls more than 65% of the browser market and has an even more dominant position in the digital advertising market. Google and other web browser developers have significant resources at their disposal and command substantial market share, and any negative user choice or restrictions they impose could foreclose our ability to understand the preferences of a substantial number of consumers. Although through continued innovation our business is relying less on third-party signals and more on first-party data- based and other identifiers, if we are blocked or restricted from collecting information on consumer preferences and serving personalized advertisements to a significant portion of internet users, our business could suffer and our results of operations could be harmed. Similarly, Internet users are increasingly able to download free or paid “ad-blocking” software, including on mobile devices, which prevent third-party cookies from being stored on a user’s computer and block advertisements from being displayed to such user. In addition, Google has introduced ad blocking software in its Chrome browser that blocks certain ads based on quality standards established under a multi-stakeholder coalition. If such a feature inadvertently or mistakenly blocks ads that are not within the established blocking standards, or if such capabilities become widely adopted and the advertising technology industry does not collaboratively develop alternative technologies, our business could be harmed. The Interactive Advertising Bureau and Digital Advertising Alliance have also developed frameworks that allow users to opt out of the “sale” of their personal information under the CCPA, in ways that stop or severely limit the ability to show targeted ads. In addition, web browsers that explicitly do not allow the tracking of data may be growing in popularity. If a significant number of web browser users switch to advertising-free services or platforms, our business could be materially impacted. For in-app advertising, data regarding interactions between users and devices are tracked mostly through stable, pseudonymous mobile device identifiers that are built into the device operating system with privacy controls that allow users to express a preference with respect to data collection for advertising, including to disable the identifier and therefore restrict or prevent targeted advertising. These identifiers and privacy controls are defined by the developers of the mobile platforms and could be changed by the mobile platforms in a way that may negatively impact our business. For example, Apple requires user opt-in before permitting access to Apple’s unique identifier, or IDFA. This shift from enabling user opt-out to an opt-in requirement has had, and is likely to continue to have, a substantial impact on the mobile advertising ecosystem and could harm our growth in this channel. User privacy features of other channels of programmatic advertising, such as Connected TV or over-the-top video, are still developing. Technical or policy changes, including regulation or industry self-regulation, could harm our growth in those channels. The data we gather is important to the continued development and success of Criteo Shopper Graph , which is a key element of the Criteo Commerce Media Platform. If too few of our clients provide us with the permission to share their data or if our clients choose to stop sharing their data, or if regulatory or other factors inhibit or restrict us from maintaining the data collectives underlying Criteo Shopper Graph, the value of Criteo Shopper Graph could be materially diminished, which could impact the performance of our products and materially impact our business. In addition, our ability to collect and use data may be restricted or prevented by other factors, including: • failure of our, or our clients’, network, hardware, or software systems; • our inability to grow our client and publisher base in new industry verticals and geographic markets to obtain the critical mass of data necessary for Criteo AI Engine to perform optimally; 23 • malicious traffic (such as non-human traffic) that introduces “noise” in the information that we collect from clients and publishers and retailer partners; and • interruptions, failures or defects in our data collection, mining, analysis and storage systems, including due to our reliance on external third-party providers for cloud computing services and data center hosting services, in a highly competitive market subject to close legal and regulatory scrutiny. Any of the above-described limitations could also harm our business and adversely impact our future results of operations. We operate in a rapidly evolving industry, which makes it difficult to evaluate our future prospects and may increase the risk that we will not be successful. Our historical growth rates may not be indicative of our future growth, and we may have difficulty sustaining profitability. We operate in a rapidly evolving industry. Our ability to forecast our future operating results is subject to several uncertainties, including our ability to plan for and model future growth in both our business and the digital advertising market. We are subject to risks and uncertainties frequently experienced by growing companies in rapidly evolving industries, including challenges in forecasting accuracy, determining appropriate nature and levels of investments, predicting adequate future headcount, assessing appropriate returns on investments, achieving market acceptance of our existing and future offerings, managing client implementations and developing new solutions. If our assumptions regarding these uncertainties, which we regularly use and update to plan our business, are incorrect or change in reaction to changes in our markets, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations and our business could suffer. You should not consider our revenue growth in past periods to be indicative of our future performance. In future periods, our revenue could decline or grow more slowly than we expect. We believe the growth of our revenue depends on several factors, including our ability to: • attract new clients, and retain and expand our relationships with existing clients; • maintain the breadth of our media owner network and attract new publishers and media owners, including large retailers, publishers of web content, mobile applications and video and social games, in order to grow the volume and breadth of advertising inventory available to us; • broaden our solutions portfolio to include additional marketing and monetization goals for commerce companies and consumer brands across the open Internet, including web, apps and stores; • adapt our offering to meet evolving needs of businesses, including to address market trends such as the (i) continued migration of consumers from desktop to mobile and from websites to mobile applications, (ii) increasing percentage of sales that involve multiple digital devices, (iii) increasing retailer adoption of retail media monetization solutions, (iv) growing adoption by consumers of “ad-blocking” software on web browsers on desktop and/or mobile devices and use by consumers of advertising-free services, (v) changes in the marketplace for and supply of advertising inventory, (vi) changes in the overall ecosystem resulting in signal loss and (vii) changes in consumer acceptance of tracking technologies for targeted or behavioral advertising purposes; • maintain and increase our access to data necessary for the performance of Criteo AI Engine; • continuously improve the algorithms underlying Criteo AI Engine and apply state-of-the-art machine learning approaches and hardware; and • continue to adapt to a changing regulatory landscape governing data use, data protection, privacy matters and AI. We also anticipate continuing to invest in our business to increase the scale of our Commerce Media Platform and attract more media spend. We cannot be certain that this strategy will be successful or result in increased liquidity or long-term value for our shareholders. We derive a significant portion of our revenue from companies in the retail, travel and classified industries, and any downturn in these industries or any changes in regulations affecting these industries could harm our business. A significant portion of our revenue is derived from companies in the Retail, Travel and Classifieds industries. For example, in 2024 and 2023 , 75.0% and 77.7 %, respectively, of our combined revenue for Performance Media was derived from advertisements placed for Retail commerce businesses. Any downturn or increased competitive pressure in any of our core industries, such as retailer bankruptcies due to poor economic conditions, or other industries we may target in the future, may cause our clients to reduce their spending with us, or delay or cancel their advertising campaigns with us. 24 We face intense competition for employee talent, and if we do not retain and continue to attract highly skilled talent or retain our senior management team and other key employees, we may not be able to achieve our business objectives. Our future success depends on our ability to continue to attract, hire, retain and motivate highly skilled employees, particularly AI experts, software engineers, product managers and other employees with the technical skills that enable us to deliver effective advertising solutions. Competition for diverse, experienced and highly skilled employees in our industry is intense, in particular in the fields of AI and data science, and we expect certain of our key competitors, who are larger than us and have access to more substantial resources, to pursue top talent on a global basis. Our future success also depends on the continued service of our senior management team. As a global team heading a global company, our management team must operate and collaborate across multiple geographies, which can make coordinated management more challenging. Business transformation periods, changes in leadership and changes due to business reorganization may result in uncertainty, impact business performance and strategies, and retention of key personnel. We may be unable to attract or retain or successfully transition the management and highly skilled personnel who are critical to our success, which could disrupt our business, hinder our ability to keep pace with innovation and technological change in our industry, drive stock price volatility, or result in harm to our key client and publisher relationships, loss of key information, expertise or proprietary knowledge and unanticipated recruitment and training costs. If we are unable to continue to successfully attract and retain highly skilled talent, senior management and maintain our corporate culture, it could adversely affect our ability to compete effectively and execute on our business strategy. As we expand the market for our solutions, we may become more dependent on advertising agencies as intermediaries, which may adversely affect our ability to attract and retain business. As we market our solutions, we may increasingly need advertising agencies to work with us in assisting businesses in planning and purchasing for broader marketing goals. In 2024 , 30% of Retail Media’s media spend and 32% of Performance Media’s media spend was spent through advertising age ncies. Overall, we believe that accessing broader advertising budgets by partnering with advertising agencies represents a significant incremental business opportunity for us, though it also may involve significant risks. For example, if we have an unsuccessful engagement with an advertising agency on a particular advertising campaign, we risk losing the ability to work not only for the client for whom the campaign was run, but also for other clients represented by that agency. The increasing presence of advertising agencies as intermediaries between us and our clients creates a challenge to building our own brand awareness and maintaining an affinity with our clients (including if clients move from one advertising agency to another), who are the ultimate sources of our revenue. In the event we were to become more dependent on advertising agencies as intermediaries, this may adversely affect our ability to attract and retain business. In addition, an increased dependency on advertising agencies may harm our results of operations, because of the increased agency fees we may be required to pay and/or because of longer payment terms from agencies. Our future success will depend in part on our ability to expand into new industry verticals. As we market our offering to a wider group of consumer brands and companies outside of our historical key industry verticals of retail, travel and classifieds, among others, we will need to adapt our solutions and effectively market our value to businesses in these new industry verticals. Our successful expansion into new industry verticals will depend on various factors, including our ability to: • accumulate sufficient data sets relevant for those industry verticals to ensure that Criteo AI Engine has sufficient quantity and quality of information to deliver efficient and effective internet display advertisements; • design solutions that are attractive to businesses in such verticals; • work with clients in new industry verticals through the agencies that manage their advertising budgets; • hire personnel with relevant industry vertical experience to lead sales and product teams; • provide high returns, and maintain such returns at scale, on advertising spend in such industries; and • transparently measure the performance of such advertising spend based on clear, measurable metrics. 25 If we are unable to successfully adapt our offering to appeal to businesses in industries other than our core verticals, or are unable to effectively market such solutions to businesses in such industries, we may not be able to achieve our growth or business objectives. Further, as we expand our client base and offering into new industry verticals, we may be unable to maintain our current client retention rates. Our future success will depend in part on our ability to expand into new advertising channels. We define an advertising channel as a specific advertisement medium to engage with a user or a consumer for which we currently purchase inventory through a specific source. We started delivering elements of our offering through internet display advertisements in desktop browsers. Since then, we have expanded into mobile in-browser and in-app, native display, including on social media platforms, and online video inventory. We may broaden the spectrum of our advertising channels further, including into Social, Connected TV and Digital Out of Home, if we believe that doing so would significantly increase the value we can offer to clients. However, any future attempts to enter new advertising channels may not be successful. Our success in expanding into any additional advertising channels will depend on various factors, including our ability to identify, adapt, innovate, market and integrate our solutions to the new advertising channels. Any decrease in the use of current advertising channels, whether due to clients losing confidence in the value or effectiveness of such channels, regulatory or technology restrictions or if we are unable to successfully adapt our solutions to additional advertising channels and effectively market such offerings to our existing and prospective clients, or if we are unable to maintain our pricing and measurement models in these additional advertising channels, may prevent us from achieving our growth or business objectives. We experience fluctuations in our results of operations due to a number of factors, which make our future results difficult to predict and could cause our operating results to fall below expectations or our guidance. Our quarterly and annual results of operations fluctuate due to a variety of factors, many of which are outside of our control. Fluctuations in our results of operations could cause our performance to fall below the expectations of analysts and investors, and adversely affect the price of our ADSs. You should not rely on our past results as an indication of our future performance. Factors that may affect our quarterly results of operations include: • the nature of our clients’ products or services, including the seasonal nature of our clients’ advertising spending; • lengthy implementation cycles of new solutions resulting in expenses incurred without any guarantee of revenue generation; • demand for our offering and the size, scope and timing of digital advertising campaigns; • for certain parts of our business, the lack of long-term agreements with some of our clients and publishers; • client and publisher retention, including concentration of any clients or publishers; • market acceptance of our offering and future solutions and services (i) in current and new industry verticals, (ii) in new geographic markets, (iii) in new advertising channels, or (iv) for broader marketing goals; • the timing of large expenditures related to expansion into new solutions, new geographic markets, new industry verticals, acquisitions and/or capital projects; • the timing of adding support for new digital devices, platforms and operating systems; • the amount of inventory purchased through direct relationships with publishers versus internet advertising exchanges or networks; • our clients’ budgeting cycles; • changes in the competitive dynamics of our industry, including consolidation among competitors; • consumers’ response to our clients’ advertisements, to online advertising in general and to tracking technologies for targeted or behavioral advertising purposes; • our ability to control costs, including our operating expenses; • network outages, errors in our technology or security breaches and any associated expense and collateral effects; • foreign currency exchange rate fluctuations, as some of foreign transactions are denominated in local currencies; • failure to successfully manage or integrate any acquisitions; and • general economic and political conditions in our domestic and international markets, including public health crises (such as the outbreak of contagious disease or pandemics) and geopolitical conflicts. As a result, we may have a limited ability to forecast future revenue and expenses, and our results of operations may from time to time fall below our estimates or the expectations of public market analysts and investors. 26 Risks Related to Data Privacy, Intellectual Property and Cybersecurity Our business involves the use, transmission and storage of personal data and confidential information, and the failure to properly safeguard such information could result in significant reputational harm and monetary damages. Our business involves the use, storage and transmission of confidential consumer, client and publisher information and personal data, including certain purchaser data, as well as proprietary software and financial, employee and operational information. Security breaches could expose us to unauthorized disclosure of this information, litigation and possible liability, as well as damage to our relationships with our clients and publisher and retailer partners. If our security measures are breached as a result of third-party action, employee or contractor error (including through use of generative AI technologies), malfeasance or otherwise and, as a result, someone obtains unauthorized access to such data, our reputation could be damaged, our business may suffer, and we could incur significant liability. Our industry is prone to cyber-attacks by third parties seeking unauthorized access to our data or users’ data or to disrupt our ability to provide services. As a result of our prominence, the size of our user base, and the volume of data in our systems, we may be a particularly attractive target for such cyber-attacks. Any failure to prevent or mitigate security breaches and improper access to or disclosure of our data or user data, trade secrets and IP, or information from our clients and publishers and retailer partners, could result in the loss or misuse of such data, which could harm our business and reputation and diminish our competitive position. In addition, computer malware/ransomware, viruses, unauthorized access or system compromises and hacking by sophisticated actors, including potential attacks from nation-state actors, have become more prevalent in our industry. Our products embed open source software, which could be subject to vulnerabilities that may make our products susceptible to cyber-attacks. We rely on cloud storage providers. There may be increased security exposure due to our use of cloud storage. Security incidents have occurred on our systems in the past, and will likely occur on our systems in the future. Our efforts to address undesirable activity on our platform may also increase the risk of retaliatory cyber-attacks. As a result, we may suffer significant legal, reputational, or financial exposure, which could adversely affect our business and results of operations. Cyber-attacks continue to constantly evolve in sophistication and volume, including with AI and machine learning, and inherently may be difficult to anticipate and detect for long periods of time. Techniques used by hackers to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target. Although we have invested in and developed systems and processes that are designed to protect data, and to prevent or detect security breaches, such measures have not provided, and cannot be expected to provide, absolute security, and we may incur significant costs in protecting against and remediating cyber-attacks. In addition, the perpetrators of such activities often are very sophisticated, and can include foreign governments and other parties with significant resources at their disposal. We may also have to expend considerable resources on determining the nature and extent of such attacks. If an actual or perceived security breach occurs, the market perception of our security measures could be harmed, and we could lose both clients and revenue. Any significant violations of data privacy or other security breaches could result in the loss of business, litigation and regulatory investigations and penalties that could damage our reputation and adversely impact our results of operations and financial condition. Moreover, if a high-profile security breach occurs with respect to another provider of digital advertising solutions, our clients and potential clients may lose trust in the security of providers of digital advertising in general, and Display Advertising solutions in particular, which could adversely impact our ability to retain existing clients or attract new ones. Additionally, hackers may attempt to fraudulently induce employees, consumers, our clients, our publisher and retail partners or third-party providers into disclosing sensitive information such as user names, passwords or other information in order to gain access to our data, our clients’ data or our publisher and retailer partners’ data, which could result in significant legal and financial exposure and a loss of confidence in the security of our offering and, ultimately, harm to our future business prospects. A party who is able to compromise the security of our facilities, including our data centers or office facilities, or any device, such as a smartphone or laptop, connected to our systems could misappropriate our, our clients’, our publishers and retail partners’ or consumers’ proprietary information, or cause interruptions or malfunctions in our operations or those of our clients and/or publishers and retailer partners. We have invested in and expended significant resources to protect against such threats and to alleviate problems caused by breaches in security and may have to expend additional resources for such purposes in the future. 27 Our insurance policies may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our policies may not cover any claim against us for loss of data or other indirect or consequential damages and defending a suit, regardless of its merit, could be costly and divert management’s attention. If we are unable to protect our proprietary information or other intellectual property, our business could be adversely affected. Our patents, trademarks, trade secrets, copyrights, and other IP rights are important assets. Various events outside of our control threaten these rights, and our products, services, and technologies. For example, effective IP protection may be resource intensive or may not be available in every country in which we operate or intend to operate. Some IP-mechanisms, such as patents, may require us to disclose otherwise confidential information to the public. Third parties may knowingly or unknowingly infringe or challenge our proprietary rights, and our pending and future trademark and patent applications may not be approved. Although we seek to obtain patent protection for our innovations, it is possible we may not be able to protect some of these innovations in a sufficient or effective manner. Moreover, we may not have adequate legal protection for certain innovations or geographies that later turn out to be important. Furthermore, despite our efforts, the protection obtained may be insufficient or an issued patent may be deemed invalid or unenforceable. Security breaches of our information systems, or those of our third-party providers or other IT resources could also result in the exposure of our proprietary information. Additionally, competitors may independently develop our trade secrets, and our protective measures may not prevent unauthorized use or reverse engineering of our trade secrets or proprietary information. To protect or enforce our IP rights, we may initiate litigation against third parties, which could be expensive, time- consuming and divert management’s attention from other business concerns. We may not prevail in any such lawsuits, and the damages or other remedies awarded, if any, may not be commercially valuable. Any increase in the unauthorized use of our IP may adversely affect our business, financial condition and results of operations. Failures in the systems and infrastructure supporting our solutions and operations, including as we scale our offerings, could significantly disrupt our operations and cause us to lose clients. Our business relies on the continued and uninterrupted performance of our software and hardware infrastructures, including Criteo AI Engine. We currently place close to five billion advertisements per day and each of those advertisements can be placed in under 100 milliseconds. Sustained or repeated system failures of our, or our third-party providers’, software or hardware infrastructures (such as massive and sustained data center or cloud service provider outages), which interrupt our ability to deliver advertisements quickly and accurately, our ability to serve and track advertisements, our ability to process consumers’ responses to those advertisements or otherwise disrupt our internal operations, could significantly reduce the attractiveness of our offering to clients and publisher and retail partners, reduce our revenue or otherwise negatively impact our financial situation, impair our reputation and subject us to significant liability. Additionally, if, for any reason, our arrangement with one or more data centers or cloud providers is terminated earlier than scheduled, we could experience difficulties and additional expense in arranging for new facilities and support, particularly given the current competitive nature of the data centers market at a worldwide scale, which involves high demands, low offers and strong pressure from providers to increase prices and diversify their client base. Any steps we take to ensure business continuity and increase the security, reliability and redundancy of our systems supporting the Criteo technology or operations may be expensive and may not be 100% successful in preventing system failures. Similarly, advancements in machine learning approaches, AI and other technologies may require us to upgrade or replace essential hardware (such as graphics processing units), which could involve substantial resources and could be difficult to implement. In addition, while we seek to maintain excess capacity to facilitate the rapid provision of new client deployments and the expansion of existing client deployments, we may need to increase and update data center hosting capacity, bandwidth, storage, power or other elements of our system architecture and infrastructure prompt to adapt and meet the continuous growth of our client base and/or our traffic. 28 The expansion and improvement of our systems and infrastructure may require us to commit substantial financial, operational and technical resources, with no assurance that third- party providers will honor such requests or that our business will increase accordingly. Our existing systems may not be able to scale up in a manner satisfactory to our existing or prospective clients, and may not be adequately designed with the necessary reliability and redundancy of certain critical portions of our infrastructure to avoid performance delays or outages that could be harmful to our business. Our failure to continuously upgrade or increase the reliability and redundancy of our infrastructure to meet the demands of a growing base of global clients and publisher and retailer partners could adversely affect the functioning and performance of our technology and could in turn affect our results of operations. Finally, our systems and the systems of our third-party providers are vulnerable to damage and increased costs from a variety of sources, some of which are outside of our control, including telecommunications failures, natural disasters, terrorism, power outages, a variety of other possible outages affecting data centers, increases in the price of energy needed to power and cool data centers, a decision to close any data center or the facilities of any other third-party provider earlier than initially scheduled, and malicious human acts, including hacking, computer viruses, malware/ ransomware and other security breaches. Techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target. As a result, we may be unable to anticipate some of these techniques or to implement adequate preventive measures. If we are unable to prevent system failures, the functioning and performance of our solutions could suffer, which in turn could interrupt our business and harm our results of operations. Our business may suffer if it is alleged or determined that our technology or another aspect of our business infringes the intellectual property rights of others. The online and mobile advertising industries are characterized by the existence of many patents, copyrights, trademarks, trade secrets and other IP and proprietary rights. Our success depends, in part, upon non-infringement of IP rights owned by others and resolving infringement or misappropriation claims without major financial expenditures or adverse consequences. From time to time, we may be the subject of claims that our services, solutions and underlying or associated technology infringe or violate the IP rights of others, particularly as we expand the scope and complexity of our business. Regardless of any merit of such claims, these claims are time-consuming and costly to evaluate and defend, and the outcome of any litigation is inherently uncertain. Some of our competitors have substantially greater resources than we do and are able to sustain the costs of complex IP litigation to a greater degree and for longer periods of time than we could. Such infringement claims could subject us to significant liabilities for monetary damages, interfere with or delay our development, commercialization or provision of our offerings on acceptable terms, harm our reputation or require technology or branding changes. In addition, we may be exposed to claims that advertising content violates the IP or other rights of third parties and although we may have the right of recourse, this may be difficult or costly to enforce. Such claims could be made directly against us or against the advertising agencies we work with, media networks and exchanges, or publishers and retailers from whom we purchase advertising inventory. Under our agreements with larger partners, including advertising agencies, media networks and exchanges, publishers and retailers, we may be required to indemnify such partners against claims related to advertisements we served. We generally require our clients to indemnify us for any damages from any such claims, but such clients may not have the ability to satisfy their indemnification obligations to us, and pursuing any claims for indemnification may be costly or unsuccessful. As a result, we may be required to satisfy our indemnification obligations to advertising agencies, media networks and exchanges, publishers and retailers or claims against us with our assets. This could harm our reputation, business, financial condition and results of operations, and could impact our relationships with partners or clients. Our inability to use software licensed from third parties, or our use of open source software under license terms that interfere with our proprietary rights, could disrupt our business. Our technology platform and internal systems incorporate software licensed from third parties, including open source software, which we use without charge. Although we monitor our use of open source software, the terms of many open source licenses to which we are subject have not been interpreted by U.S. or foreign courts, and such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to provide our technology offering to our clients. In the future, we could be required to seek licenses from third parties to continue offering our solutions, which licenses may not be available on acceptable terms, or at all. 29 Alternatively, we may need to re-engineer our offerings or discontinue certain functionalities provided by our technology. In addition, the terms of open source software licenses may require us to provide software that we develop using such software to others on unfavorable terms, such as by precluding us from charging license fees or by requiring us to disclose our source code. Any such restriction on the use of our own software, or our inability to use open source or third- party software, could disrupt our business or operations, or delay our development of future offerings or enhancements of our existing platform, which could impair our business. Risks Related to Ownership of Our Shares and the ADSs and the Trading of the ADSs The market price for the ADSs has been and may continue to be volatile or may decline regardless of our operating performance. The trading price of the ADSs has significantly fluctuated, and is likely to continue to fluctuate, substantially. The trading price of the ADSs depends on several factors, including those described in this “Risk Factors” section, many of which are beyond our control and may not be related to our operating performance. Since the ADSs were sold at our initial public offering in October 2013 at a price of $31.00 per share, the price per ADS has ranged as low as $ 5 .89 and as high as $60.95 through December 31, 2024 . The market price of the ADSs has fluctuated and may fluctuate significantly in response to numerous factors, many of which are beyond our control, including: • actual or anticipated fluctuations in our revenue and other results of operations; • the guidance we may provide to the public, any changes in this guidance or our failure to meet this guidance; • investor perception of risks in our industry; • failure of securities analysts to initiate or maintain coverage of us and our securities, changes in financial estimates by any securities analysts who follow our company, or our failure to meet these estimates or the expectations of investors; • announcements by us, our competitors or large influential technology companies of significant technical innovations or changes, acquisitions, strategic partnerships, joint ventures or capital commitments; • changes in operating performance and stock market valuations of advertising technology or other technology companies, or those in our industry in particular; • investor sentiment with respect to our competitors, business partners or industry in general; • price and volume fluctuations in the overall stock market, including due to trends in the economy as a whole; • additional ADSs being sold into the market by us or the Company’s insiders; • media coverage of our business and financial performance; • developments in anticipated or new legislation or new or pending lawsuits or regulatory actions; • other events or factors, including resulting from economic recessions, political conditions, natural disasters or weather events, cybersecurity incidents, pandemics, war, terrorism or other catastrophic events or responses; and • any other risks identified in this Form 10-K. In addition, stock markets have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many technology companies. Stock prices of many technology companies have fluctuated in a manner unrelated or disproportionate to the operating performance of those companies. In the past, shareholders have instituted securities class action litigation following periods of market volatility. Because of the past and the potential future volatility of our stock price, we may become the target of securities litigation in the future. If we were to become involved in securities litigation, it could subject us to substantial costs, divert resources and the attention of management from our business and adversely affect our business. Actions of activist shareholders could impact the pursuit of our business strategies and adversely affect our results of operations, financial condition, or share price. We have been, and may in the future be, subject to activities initiated by activist shareholders. We may not always be successful in engaging constructively with one or more shareholders, and any resulting activist campaign could have an adverse effect on us. It is possible that responding to actions by activist shareholders could disrupt our business and operations, be costly or time-consuming, or divert the attention of our board of directors or senior management. In addition, perceived uncertainties about our future direction may result in a loss of potential business opportunities and harm our ability to attract and retain customers, employees and business partners. Any such actions also may cause the market price of our shares to experience volatility, which could be significant. 30 We may need additional capital in the future to meet our financial obligations and to pursue our business objectives. Additional capital may not be available on favorable terms, or at all, and may contain restrictions which could compromise our ability to meet our financial obligations and operate and grow our business. We currently have a senior unsecured revolving credit facility under which we may borrow up to €407 million (or its equivalent in U.S. dollars) for general corporate purposes, including the funding of business combinations (the "General RCF"). Maturity of this facility is in September 2027. While we anticipate that our existing cash and cash equivalents and short- term investments will be sufficient to fund our operations for at least the next 12 months, we intend to continue growing our business, including through retail media, and as such, we cannot assure that we will be able to generate sufficient cash flow from operations or that future borrowings will be available under our General RCF in an amount sufficient to fund, among other things, the capital requirements of retail media, new product development, or our future working capital needs. If we may need to raise additional capital to fund operations and growth in the future or to finance acquisitions and adequate funds are not available on acceptable terms, we may be unable to fund the expansion of our research and development and sales and marketing efforts, the development of new features or enhancements to our products, increase working capital, take advantage of acquisition or other opportunities, or adequately respond to competitive pressures which could seriously harm our business and results of operations. Furthermore, if we raise additional funds through the issuance of additional equity securities, shareholders will experience dilution, and the new equity securities could have rights senior to those of our ordinary shares. The credit agreement for the General RCF contains, and documents governing our future indebtedness may contain, numerous covenants that limit the discretion of management with respect to certain business matters. These covenants place restrictions on, among other things, our ability and the ability of our subsidiaries to incur or guarantee additional indebtedness, pay dividends, sell certain assets or engage in mergers and acquisitions, and create liens. Our credit agreement also requires, and documents governing our future indebtedness may require, us or our subsidiaries to meet certain financial ratios and tests. To the extent we draw on the General RCF or incur new debt, the debt holders have rights senior to shareholders to make claims on our assets. The breach of any of these covenants or noncompliance with any of these financial ratios and tests could result in an event of default under the applicable debt agreement, which, if not cured or waived, could result in acceleration of the related debt and the acceleration of debt under other instruments evidencing indebtedness that may contain cross- acceleration or cross-default provisions. Our business could be negatively impacted by the activities of hedge funds or short sellers. There is the risk that we may be subject, from time to time, to challenges arising from the activities of hedge funds, short sellers or similar individuals who may not have the best interests of shareholders or the Company in mind. Reports or other publications prepared and disseminated by such hedge funds or short sellers may cause significant fluctuations in our stock price based on temporary or speculative market perceptions or other factors that do not necessarily reflect the underlying fundamentals and prospects of our business, and could cause the price of our ADSs or trading volume to decline. Furthermore, responding to such activities could be costly and time-consuming and may be intended to, and may in fact, divert the attention of our board of directors and senior management from the pursuit of our business strategies and adversely affect our business. We do not currently intend to pay dividends on our securities and, consequently, the ability to achieve a return on your investment will depend on appreciation in the price of the ADSs. In addition, French law may limit the amount of dividends we are able to distribute. We have never declared or paid any cash dividends on our ordinary shares and do not currently intend to do so for the foreseeable future. We currently intend to invest our future earnings, if any, to fund our growth, both organic and inorganic. In addition, we have used a portion of our available liquidity to repurchase our shares in the past (such repurchases being limited as per French law in scope (employee incentive purposes or external growth purposes only) and in amount (notably the Company cannot hold more than 10% of its share capital at any time)), and may continue to do so from time to time in the future. In addition, to the extent we pay any dividends or repurchase our shares followed by their cancellation in the future, under French law, such actions may subject us to additional taxes, which are uncertain and subject to change from time to time. 31 The determination of whether we have been sufficiently profitable to pay dividends is made on the basis of our statutory financial statements prepared and presented in accordance with accounting principles generally accepted in France. Therefore, we may be more restricted in our ability to declare dividends than companies not based in France. Please see the subsection entitled “French Tax Consequences” in Item 5 of Part II in this Form 10-K for further details on such taxes and limitations. Finally, exchange rate fluctuations may affect the amount of euros that we are able to distribute, and the amount in U.S. dollars that our shareholders receive upon the payment of cash dividends or other distributions we declare and pay in euros, if any. These factors could harm the value of ADSs, and, in turn, the U.S. dollar proceeds that holders receive from the sale of ADSs. Because you are not likely to receive any dividends on your ADSs for the foreseeable future, the success of an investment in ADSs will depend upon any future appreciation in their value. Consequently, investors may need to sell all or part of their holdings of ADSs after price appreciation, which may never occur, as the only way to realize any future gains on their investment. Our by-laws and French corporate law contain provisions that may delay or discourage a sale of the Company. Provisions contained in our by-laws and the corporate laws of France, the country in which we are incorporated, could make it more difficult for a third party to acquire us, even if doing so might be beneficial to our shareholders. In addition, provisions of our by-laws impose various procedural and other requirements, which could make it more difficult for shareholders to effect certain corporate actions. These provisions include, but are not limited to, the following: • our ordinary shares are in registered form only and we must be notified of any transfer of our shares for such transfer to be validly registered; • under French law, certain investments in any entity governed by a French law relating to certain strategic industries and activities (such as data processing, transmission or storage activities) by individuals or entities not French, not resident in France or controlled by entities not French or not resident in France are subject to prior authorization of the Minister of Economy (see the section entitled "Exchange Controls & Ownership by Non- French Residents" in Item 5 to Part II in this Form 10-K); • provisions of French law allowing the owner of 90% of the share capital or voting rights of a public company to force out the minority shareholders following a tender offer made to all shareholders are only applicable to companies listed on a stock exchange of the EU and will therefore not be applicable to us; • a merger (i.e., in a French law context, a stock-for-stock exchange in which our Company would be dissolved into the acquiring entity and our shareholders would become shareholders of the acquiring entity) of our Company into a company incorporated outside of the EU would require the unanimous approval of our shareholders; • a merger of our Company into a company incorporated in the EU would require the approval of our board of directors as well as a two-thirds majority of the votes held by the shareholders present, represented by proxy or voting by mail at the relevant extraordinary shareholders' meeting; • under French law, a cash merger is treated as a share purchase and would require the consent of each participating shareholder; and • our shareholders have preferential subscription rights proportionate to their shareholding on the issuance by us of any additional securities for cash or a set-off of cash debts, which rights may only be waived by the extraordinary general meeting (by a two-thirds majority vote) of our shareholders or on an individual basis by each shareholder. You may not be able to exercise your right to vote the ordinary shares underlying your ADSs. Holders of ADSs may exercise voting rights with respect to the ordinary shares represented by ADSs only in accordance with the provisions of the deposit agreement, as amended from time to time. The deposit agreement provides that, upon receipt of notice of any meeting of our ordinary shareholders, the depositary will fix a record date for the determination of ADS holders entitled to give instructions for the exercise of voting rights. Upon timely receipt of notice from us, if we so request, the depositary shall distribute to the holders as of the record date (1) the notice of the meeting or solicitation of consent or proxy sent by us and (2) a statement on the manner that instructions may be given by the holders. You may instruct the depositary of your ADSs to vote the ordinary shares underlying your ADSs. Otherwise, you will not be able to exercise your right to vote, unless you withdraw the ordinary shares underlying the ADSs you hold. However, you may not know about the meeting far enough in advance to withdraw those ordinary shares. If we ask for your instructions, the depositary, upon timely notice from us, will notify you of the upcoming vote and arrange to deliver our voting materials to you. We cannot guarantee you that you will receive the voting materials in time to ensure that you can instruct the depositary to vote or to withdraw your ordinary shares so that you can vote them yourself. 32 If the depositary does not receive timely voting instructions from you, it may give a proxy to a person designated by us to vote the ordinary shares underlying your ADSs. In addition, the depositary and its agents are not responsible for failing to carry out voting instructions or for the manner of carrying out voting instructions. This means that you may not be able to exercise your right to vote, and there may be nothing you can do if the ordinary shares underlying your ADSs are not voted as you requested. Your right as a holder of ADSs to participate in any future preferential subscription rights or to elect to receive dividends in shares may be limited, which may cause dilution to your holdings. According to French law, if we issue additional securities for cash, current shareholders will have preferential subscription rights for these securities proportionally to their shareholding in our Company unless they waive those rights at an extraordinary meeting of our shareholders (by a two-thirds majority vote) or individually by each shareholder. However, our ADS holders in the U.S. will not be entitled to exercise or sell such rights unless we register the rights and the securities to which the rights relate under the Securities Act or an exemption from the registration requirements is available. In addition, the deposit agreement provides that the depositary will not make rights available to you unless the distribution to ADS holders of both the rights and any related securities are either registered under the Securities Act or exempted from registration under the Securities Act. Further, if we offer holders of our ordinary shares the option to receive dividends in either cash or shares, under the deposit agreement the depositary may require satisfactory assurances from us that extending the offer to holders of ADSs does not require registration of any securities under the Securities Act before making the option available to holders of ADSs. We are under no obligation to file a registration statement with respect to any such rights or securities or to endeavor to cause such a registration statement to be declared effective. Moreover, we may not be able to establish an exemption from registration under the Securities Act. Accordingly, ADS holders may be unable to participate in our rights offerings or to elect to receive dividends in shares and may experience dilution in their holdings. In addition, if the depositary is unable to sell rights that are not exercised or not distributed or if the sale is not lawful or reasonably practicable, it will allow the rights to lapse, in which case you will receive no value for these rights. You may be subject to limitations on the transfer of your ADSs and the withdrawal of the underlying ordinary shares. Your ADSs, which may be evidenced by American Depositary Receipts, are transferable on the books of the depositary. However, the depositary may close its books at any time or from time to time when it deems expedient in connection with the performance of its duties. The depositary may refuse to deliver, transfer or register transfers of your ADSs generally when our books or the books of the depositary are closed, or at any time if we or the depositary think it is advisable to do so because of any requirement of law, government or governmental body, or under any provision of the deposit agreement, or for any other reason subject to your right to cancel your ADSs and withdraw the underlying ordinary shares. Temporary delays in the cancellation of your ADSs and your withdrawal of the underlying ordinary shares may arise because the depositary has closed its transfer books or we have closed our transfer books, the transfer of ordinary shares is blocked to permit voting at a shareholders’ meeting or we are paying a dividend on our ordinary shares. In addition, you may not be able to cancel your ADSs and withdraw the underlying ordinary shares when you owe money for fees, taxes and similar charges and when it is necessary to prohibit withdrawals to comply with any laws or governmental regulations that apply to ADSs or to the withdrawal of ordinary shares or other deposited securities. U.S. investors may have difficulty enforcing civil liabilities against our Company, directors and senior management. Certain of our directors and members of senior management, and those of certain of our subsidiaries, are non-residents of the U.S., and all or a substantial portion of our assets and the assets of such persons are located outside the U.S. As a result, it may not be possible to serve process on such persons or us in the U.S. or to enforce judgments obtained in U.S. courts against them or us based on civil liability provisions of the securities laws of the U.S. Additionally, it may be difficult to assert U.S. securities law claims in actions originally instituted outside of the U.S. 33 Foreign courts may refuse to hear a U.S. securities law claim because foreign courts may not be the most appropriate forums in which to bring such a claim. Even if a foreign court agrees to hear a U.S. securities law claim, it may determine that the law of the jurisdiction in which the foreign court resides, and not U.S. law, is applicable to the claim. Further, if U.S. law is found to be applicable, the content of applicable U.S. law must be proved as a fact, which can be a time-consuming and costly process, and procedural rules would still be governed by the law of the jurisdiction in which the foreign court resides. In particular, there is some doubt as to whether French courts would recognize and enforce certain civil liabilities under U.S. securities laws in original actions or judgments of U.S. courts based upon these civil liability provisions. In addition, damages exceeding the actual damages in actions brought in the U.S. or elsewhere, such as punitive damages, may be unenforceable in France. The enforceability of any judgment in France will depend on the particular facts of the case as well as the laws and treaties in effect at the time. The U.S. and France do not currently have a treaty providing for recognition and enforcement of judgments (other than arbitration awards) in civil and commercial matters; therefore, the recognition and enforcement of any such judgment would be subject to French procedural law and may not be granted. The rights of shareholders in companies subject to French corporate law differ in material respects from the rights of shareholders of corporations incorporated in the U.S. We are a French company with limited liability. Our corporate affairs are governed by our by-laws and by the laws governing companies incorporated in France. The rights of shareholders and the responsibilities of our board of directors are in many ways different from the rights and obligations of shareholders in companies governed by U.S. laws. For example, in the performance of its duties, our board of directors is required by French law to consider the interests of our Company while taking into consideration its social and environmental challenges, its shareholders, its employees and other stakeholders, rather than solely our shareholders and/or creditors. It is possible that some of these parties will have interests that are different from, or in addition to, your interests as a shareholder. General Risk Factors In periods of macroeconomic and geopolitical uncertainty, businesses may delay or reduce their spending on advertising, which may expose us to the credit risk of some of our clients and adversely affect our business, financial condition, results of operations and/or cash flows. Our business depends in part on worldwide economic conditions and on the overall demand for advertising and the economic health of advertisers that benefit from our platform. Global economies, including the U.S. and Europe, are being impacted by adverse economic conditions, including inflation, fluctuating interest rates, recessions, volatility in credit, equity and foreign exchange markets, bankruptcies and overall uncertainty with respect to the economy. These conditions coupled with geopolitical instability, such as the current conflicts in the Middle East and Ukraine, make it difficult for our clients and us to accurately forecast and plan future business activities, and may result in businesses reducing or delaying advertising spending in general and on a solution such as ours. Additionally, we are exposed to credit risks due to our financing activities and our evolving client portfolio involving varied payment terms, which could result in further exposure if our clients are adversely affected by any such macroeconomic uncertainty. The timing of receipt of payment from our clients may impact our cash flows and working capital. If any such macroeconomic conditions remain uncertain, persist, spread or deteriorate further, this could continue to significantly impact, our operating results, financial condition and cash flows. Our failure to maintain certain tax regimes applicable to French technology companies may adversely affect our results of operations. As a French technology company, we have benefited from certain tax advantages, linked to IP or research and developments. The French tax authority may audit these tax incentives and challenge all or part of their benefits. In such a case, we could be liable for additional corporate tax, and penalties and interest related thereto, which could have an impact on our results of operations and future cash flows. Furthermore, the tax laws may change, and could remove these incentives in the future or reduce their benefits. 34 We are a multinational organization facing increasingly complex tax issues in many jurisdictions, and new taxes or laws, or revised interpretations thereof, that may negatively affect our results of operations. As a multinational organization operating in multiple jurisdictions, we are subject to taxation in several jurisdictions around the world with increasingly complex foreign trade regulations, policies and tax laws, the application of which can be uncertain. The amount of taxes we pay in these jurisdictions could increase substantially as a result of changes in the applicable tax principles and policies, including potential new tariffs or withholding taxes, increased tax rates, the OECD- led reforms, potential retaliatory measures by affected jurisdictions, new tax laws or revised interpretations of existing tax laws and precedents, which could have a material adverse effect on our liquidity and results of operations. If we fail to maintain an effective system of internal controls, we may be unable to accurately report our financial results or prevent fraud, and investor confidence and the market price of ADSs may be adversely impacted. As a public company, we are required to maintain internal controls over financial reporting (“ICFR”) and to report any material weaknesses in such internal control. In addition, we are required to submit a report by management to the Audit Committee and external auditors on the effectiveness of our ICFR pursuant to Section 404 of the Sarbanes-Oxley Act (“SOX”) and our independent registered public accounting firm is required to attest to the effectiveness of our ICFR. If we identify material weaknesses in our ICFR, if we are unable to comply with the requirements of Section 404 of SOX in a timely manner or assert that our ICFR are effective, or if our independent registered public accounting firm is unable to express an opinion as to the effectiveness of our ICFR when required, investors may lose confidence in the accuracy and completeness of our financial reports and the market price of ADSs may be adversely impacted, and we could become subject to investigations by the stock exchange on which our securities are listed, the SEC, or other regulatory authorities, which could require additional financial and management resources. U.S. Holders of our ADSs may suffer adverse tax consequences if we are treated as a “passive foreign investment company” for U.S. federal income tax purposes. A non-U.S. corporation will be considered a “passive foreign investment company”, or PFIC, for U.S. federal income tax purposes, for any taxable year if either (1) at least 75% of its gross income for such year is passive income or (2) at least 50% of the value of its assets (based on an average of the quarterly values of the assets during such year) is attributable to assets that produce or are held for the production of passive income. Passive income includes, among other things, dividends, interest, certain non-active rents and royalties, net gains from the sale or exchange of property producing such income and net foreign (non-U.S.) currency gains. For this purpose, cash and assets readily convertible into cash are generally categorized as passive assets, subject to a limited exception under proposed regulations in respect of working capital held in a non-interest bearing financial account for the present needs of an active trade or business to cover operating expenses reasonably expected to be paid within 90 days. Goodwill and other un-booked intangibles are taken into account and being characterized as either active or passive, as appropriate; for example, our goodwill associated with active business activity is taken into account as a non- passive asset. As the value of our assets for purposes of the above-mentioned PFIC asset test will generally be determined by reference to the market value of our ADSs, the determination of whether we will be or become a PFIC will depend in large part upon the market value of our ADSs, which we cannot control. Accordingly, fluctuations in the market price of our ADSs may cause us to become a PFIC for the current taxable year or future taxable years. The determination of whether we will be or become a PFIC will also depend, in part, upon the nature of our income and the valuation of our assets, including goodwill, which are subject to change from year to year. Moreover, as we have valued our goodwill based on the market value of our ADSs, a decrease in the price of ADSs may also result in becoming a PFIC. The composition of our income and assets may also be affected by how, and how quickly, we use our liquid assets. For purposes of the above-mentioned PFIC tests, we will be treated as if we held our proportionate share of the assets and received directly our proportionate share of the income of any other corporation in which we directly or indirectly own at least 25% (by value) of the shares of such corporation. Based on the value and composition of our assets, although not free from doubt, we do not believe we were a PFIC for the taxable year ended December 31, 2024 , and we do not anticipate becoming a PFIC in the current taxable year or the foreseeable future. 4 A U.S. Holder is (1) a legal and/or a beneficial owner of our ADSs and (2) a U.S. person for U.S. federal income tax purposes, specifically: (i) an individual who is a citizen or resident of the United States for U.S. federal income tax purposes; (ii) a corporation, or other entity treated as an association taxable as a corporation for U.S. federal income tax purposes, that is created in, or organized under the law of the United States, any state thereof or the District of Columbia; (iii) an estate the income of which is includible in gross income for U.S. federal income tax purposes regardless of its source or whether or not the income is effectively connected with the conduct of a U.S. trade or business; (iv) a trust, the administration of which is subject to the primary supervision of a U.S. court and which has one or more U.S. persons who have the authority to control all substantial decisions of the trust; or (v) a person that has otherwise validly elected to be treated as a U.S. person under the U.S. Internal Revenue Code of 1986 (as amended). 35 The determination of whether we are a PFIC is a fact-intensive determination that must be made on an annual basis applying principles and methodologies that are in some circumstances unclear. Since a separate factual determination as to whether we are or have become a PFIC must be made each year (after the close of such year), we cannot assure that we will not be or become a PFIC in the current year or any future taxable year. If we were to be classified as a PFIC for any taxable year during which a U.S. Holder 4 holds our ADSs, we would continue to be treated as a PFIC with respect to that U.S. Holder for such taxable year and, unless the U.S. Holder makes certain elections, for future years even if we cease to be a PFIC. The U.S. Holder may be subject to adverse tax consequences, including (1) the treatment of all or a portion of any gain on disposition of our ADSs as ordinary income (and therefore ineligible for the preferential rates that apply to capital gains with respect to non-corporate U.S. persons), (2) the application of an interest charge with respect to such gain and on the receipt of certain dividends on our ADSs and (3) required compliance with certain reporting requirements. Each U.S. Holder is strongly urged to consult its tax advisor regarding the application of these rules and the availability of any potential elections. For further information regarding the U.S. federal income tax considerations relevant to our potential status as a PFIC, please see the section entitled “U.S. Federal Income Tax Considerations for U.S. Holders-PFIC Rules” in this Form 10-K. If a U.S. Holder is treated as owning at least 10% of our ADSs, such person may be subject to adverse U.S. federal income tax consequences. If a U.S. Holder is treated as owning (directly, indirectly, or constructively through attribution) at least 10% of the total value of our stock or at least 10% of the total combined voting power of all classes of our stock entitled to vote, such person may be treated as a “United States shareholder” (“U.S. Shareholder”) with respect to each “controlled foreign corporation” (“CFC”) in our group (if any). A non-U.S. entity treated as a corporation for U.S. tax purposes will constitute a CFC if one or more such U.S. Shareholders (generally defined as U.S. persons that-directly, indirectly, or constructively through attribution-own at least 10% of the vote or value of the entity) own in the aggregate more than 50% of the entity’s total vote or value. If we are classified as both a CFC and a PFIC (as defined above), we generally will not be treated as a PFIC with respect to those U.S. Holders that are U.S. Shareholders during the period in which we are a CFC. We do not believe we are currently a CFC. However, no assurances can be given that we are not a CFC or that we will not become a CFC in the future. Because our group includes one or more U.S. corporations, certain of our non-U.S. corporate subsidiaries could be treated as CFCs (regardless of whether or not we are treated as a CFC). A U.S. Shareholder of a CFC may be required to report annually and include in its U.S. taxable income its pro rata share of “Subpart F income,” “global intangible low-taxed income,” and investments of earnings in U.S. property by CFCs, regardless of whether we make any distributions to our shareholders. Subpart F income generally includes dividends, interest, certain non-active rents and royalties, gains from the sale of securities and income from certain transactions with related parties, and “global intangible low-taxed income” generally consists of net income of the CFC, other than Subpart F income and certain other types of income, in excess of certain thresholds. In addition, a U.S. shareholder that realizes gain from the sale or exchange of shares in a CFC may be required to classify a portion of such gain as dividend income rather than capital gain. Failure to comply with such reporting requirements could result in adverse tax effects for U.S. Shareholders and potentially significant monetary penalties. An individual that is a U.S. Shareholder with respect to a CFC generally would not be allowed certain tax deductions or foreign tax credits that would be allowed to a U.S. Shareholder that is a U.S. corporation. The determinations of CFC status and U.S. Shareholder status are complex and includes attribution rules, the application of which are not entirely certain. We cannot provide any assurances that we will assist investors in determining whether any of our non-U.S. subsidiaries is treated as a CFC or whether any investor is a U.S. Shareholder, or that we will furnish to any U.S. Shareholders information that may be necessary to comply with the aforementioned obligations. A U.S. Holder should consult its advisors regarding the potential application of these rules to an investment in our ADSs. 36