Regulatory (Security, Privacy, Data Protection and AI)
We are subject to various foreign, federal, state, and local laws, rules and regulations, industry standards, and other legal obligations that affect companies conducting business on mobile platforms, including those relating to privacy, data protection, AI, the Internet, behavioral advertising, mobile applications, content, advertising and marketing activities and consumer protection. New and evolving laws, rules and regulations, industry standards, and other legal obligations, and trends and changes in their enforcement and interpretation (including, for example, by the SEC’s CETU), may require changes to our technology, solutions, or business practices, which may significantly limit the ways in which we collect, use, receive, store, disclose, maintain, transfer and otherwise process data, including personal information of individuals, communicate with customers, serve advertisements and generally operate our business. This may increase our compliance costs and otherwise adversely affect our business and results of operations. As our business expands to include additional solutions, including AI technologies, and industries, and our operations continue to expand internationally, our compliance requirements and costs may increase and we may be subject to increased regulatory scrutiny.
The data we collect and otherwise process is integral to our business, technology, solutions and services, and provides us with insights to optimize our software. Our business subjects us to numerous foreign and U.S. state and federal laws, rules and regulations addressing privacy, data protection and the collection, storing, sharing, use, transfer, disclosure, protection and other processing of certain types of data. Such laws, rules and regulations include, for example, the EU GDPR as implemented by EU member states, ePrivacy Directive implementations, the Privacy and Electronic Communications Directive 2002/58/EC, the UK Data Protection Act 2018, the UK Data Use and Access Act 2025 and the UK GDPR, Brazil’s LGPD, China’s DSL, PIPL and CSL, COPPA, Section 5 of the FTC Act, the CCPA and other U.S. state privacy legislation, and other applicable laws, rules and regulations globally. Non-compliance with these laws could result in significant fines, regulatory investigations and inquiries, reputational damage, orders to cease or change our practices or policies with respect to the processing of data, enforcement notices or assessment notices for a compulsory audit, civil claims for damages, and associated costs, diversion of internal resources and time and attention from management. Although we take extensive efforts to comply with all applicable laws, rules and regulations, we can provide no assurance that we will not be subject to litigation or regulatory or private actions, including substantial fines, for non-compliance with such laws, rules and regulations, including in the event of a data breach or security incident. In addition, operating system platform providers or app stores, such as Apple or Google, or other relevant third parties may change their technical requirements, guidelines, terms of use or policies in a manner that adversely impacts the way in which we or our customers collect, use, share and otherwise process data from end-user devices. Restrictions on our ability to collect, use, share and otherwise process data from end-user devices as desired could negatively impact our platform and have a material adverse effect on our and our customers’ businesses.
In addition, regulatory developments, including the Bulk Data Rule (as described in the “Risks Related to Legal and Regulatory Matters” section), could have a material adverse effect on our business and that of our customers. Failure to comply with the Bulk Data Rule may result in significant fines and regulatory investigations, and could materially and adversely affect our investment activities, operational flexibility, and our ability to achieve our investment objectives.
We work to comply with applicable laws, regulations and frameworks relating to privacy, data protection and information security, and AI. We have implemented a comprehensive data privacy program, designed for compliance, risk mitigation, and supporting future growth, that strives to adhere to applicable privacy and data protection laws and frameworks including the GDPR, the CCPA and Apple’s “App Tracking Transparency” privacy framework with respect to app user activity tracking. We maintain a dedicated team, with clear roles and responsibilities and executive management oversight, that is responsible for overseeing compliance with data protection, privacy, information security and AI laws, rules, regulations, policies and standards that are applicable to our business, and have appointed a Data Protection Officer. We also maintain privacy information notices for individuals whose personal information is processed, collect consent where required, enter into data processing agreements, conduct data protection impact assessments, product and feature reviews, maintain lists of data that we collect and process, respond to privacy-related queries and requests, and conduct annual employee security awareness training and role-based privacy training for teams handling personal data. This helps underpin our strategy of building trust and providing a strong experience to customers. We take a variety of technical and organizational security measures and other procedures and protocols to protect data, including data pertaining to customers and employees. We source data through vetted channels, and operate our models on aggregated, anonymized data where feasible, with personalized data used only with explicit user consent or otherwise as permitted by law. We believe we are well-positioned within the evolving regulatory landscape, with technology designed to operate effectively under current privacy constraints. However, despite measures we put in place, we may be unable to anticipate, prevent or effectively or timely remediate any unauthorized access to, use or disclosure of data, including personal information.
To read more about our approach to laws, rules and regulations relating to privacy, data protection, and information security, please see the section titled “Risk Factors—Risks Related to Legal and Regulatory Matters—We are subject to laws, rules, regulations, industry standards and contractual obligations concerning privacy, information security, data protection, the use and sharing of data, the provision of digital services, anti-trust, AI, breach notification, consumer protection, advertising, tracking, targeting, and protection of minors, and these laws, rules, regulations and industry standards are continually evolving and increasingly