Advantage Solutions (ADV) Risk Analysis

Consumer goods manufacturers and retailers are subject to a broad range of federal, state, local and international laws and regulations governing, among other things, the research, development, manufacture, distribution, marketing and post-market reporting of consumer products. These include laws administered by the U.S. Food and Drug Administration (the "FDA"), the U.S. Drug Enforcement Administration, the U.S. Federal Trade Commission, the U.S. Department of Agriculture and other federal, state, local and international regulatory authorities. For example, certain of our clients market and sell products containing cannabidiol ("CBD"). CBD products are subject to a number of federal, state, local and international laws and regulations restricting their use in certain categories of products and in certain jurisdictions. In particular, the FDA has publicly stated it is prohibited to sell into interstate commerce food, beverages or dietary supplements that contain CBD. These laws are broad in scope and subject to evolving interpretations, which could require us to incur costs associated with new or modified compliance requirements or require us or our clients to alter or limit our activities, including marketing and promotion, of such products, or to remove them from the market altogether. If a regulatory authority determines that we or our current or future clients have not complied with the applicable regulatory requirements, our business may be materially impacted, and we or our clients could be subject to enforcement actions or loss of business. We cannot predict the nature of any future laws, regulations, interpretations or applications of the laws, nor can we determine what effect additional laws, regulations or administrative policies and procedures, if and when enacted, promulgated and implemented, could have on our business.

As further described elsewhere in this Annual Report, we acquired the business of Take 5 Media Group in April 2018, and a result of an investigation into that business, we terminated all operations of the Take 5, including the use of its associated trade names and the offering of its services to its clients and offered refunds to clients of collected revenues attributable to the period after our acquisition. See "Management's Discussion and Analysis of Financial Condition and Results of Operations - Take 5 Matter" and "Legal Proceedings." As a result of these matters, we may be subject to a number of additional harms, risks and uncertainties, including substantial costs for legal fees in connection with or related to the potential lawsuits by clients or other interested parties who claim to have been harmed by the misconduct at Take 5, other costs and fees related to the Take 5 Matter (in excess of the amounts already being offered as refunds), potential governmental investigations arising from the Take 5 Matter. In addition, if we do not prevail in any such litigation related to these matters, we could be subject to costs related to such litigation, including equitable relief, civil monetary damages, treble damages, or repayment, which may not be covered by insurance or may materially increase our insurance costs. We have incurred and will continue to incur additional costs regardless of the outcome of any such litigation or governmental investigation. In addition, there can be no assurance to what degree, if any, we will be able to recover any such costs or damages from the former owners of Take 5 or whether such former owners of Take 5 engaged in further unknown improper activities that may subject us to further costs or damages, including potential reputational harm. Likewise, such events have caused and may cause further diversion of our management's time and attention. Any adverse outcome related to these matters cannot be predicted at this time, and may materially harm our business, reputation, financial condition and/or results of operations, or the trading price of our securities.

A variety of federal, state and foreign laws and regulations govern the collection, use, retention, sharing and security of personal information. The information, security and privacy requirements imposed by such governmental laws and regulations relating to privacy, data protection and consumer protection are increasingly demanding, quickly evolving and may be subject to differing interpretations. These requirements may not be harmonized, may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another or may conflict with other rules or our practices. As a result, our practices may not have complied or may not comply in the future with all such laws, regulations, requirements and obligations. Our actual or perceived failure to comply with such laws and regulations could result in fines, investigations, enforcement actions, penalties, sanctions, claims for damages by affected individuals, and damage to our reputation, among other negative consequences, any of which could have a material adverse effect on its financial performance. We are subject to the California Consumer Protection Act of 2018, which became effective in 2020, as well as its amendment, the California Privacy Rights Act of 2020 ("CPRA," and together, the "CCPA"), which went into effect on January 1, 2023. The CCPA regulates the collection, use and processing of personal information relating to California residents, and which grants certain privacy rights to California residents, including rights to request access to and to request deletion of personal information relating to such individuals under certain circumstances. Compliance with the new obligations imposed by the CCPA depends in part on how its requirements are interpreted and applied by the California attorney general, courts, and the new California Privacy Protection Agency. Alleged violations of the CCPA may result in substantial civil penalties or statutory damages when applied at scale, up to $2,500 per violation or $7,500 per intentional violation of any CCPA requirement, which may be applied on a per-person or per-record basis. The CCPA also establishes a private right of action if certain personal information of individuals is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of a business's violation of the duty to implement and maintain reasonable security procedures and practices, which authorizes statutory damages $100 to $750 per person per incident even if there is no actual harm or damage to plaintiffs. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. Further, the CPRA includes additional and strengthened privacy rights for California residents, new requirements regarding sensitive data and data sharing for digital advertising, and tripled damages for violations involving children's data. The selling and sharing of personal information by businesses for digital advertising and marketing purposes remains a priority of regulators, including the Federal Trade Commission and California Attorney General. In August 2022, the California Attorney General announced its first enforcement action under the CCPA against a retailer that to pay penalties and comply with injunctive terms, including overhauling its online disclosures and opt-out rights and providing regular reports to the California Attorney General regarding its data sharing practices. On January 27, 2023, the California Attorney General announced another CCPA enforcement sweep targeted at businesses with mobile apps, including popular apps in the retail, travel, and foodservice industries. Four other states –Virginia, Colorado, Connecticut, and Utah – passed their own comprehensive privacy laws that went into effect throughout 2023. Seven states (Texas, Tennessee, Oregon, Montana, Iowa, Indiana, Delaware) passed their own comprehensive privacy laws in 2023 which will go into effect throughout 2024-2026. Like the CCPA, these laws regulate the collection, use and processing of personal information relating to residents of the respective states, and grants certain privacy rights to those residents. Other states are expected to consider and potentially pass similar privacy laws in 2024 and future years. We are also subject to international privacy laws and regulations, many of which, such as the General Data Privacy Regulation ("GDPR") and national laws implementing or supplementing the GDPR, such as the United Kingdom Data Protection Law 2018 (which retains key features of GDPR post-Brexit), are significantly more stringent than those currently enforced in the United States. The GDPR requires companies to meet requirements regarding the handling of personal data of individuals located in the European Economic Area (the "EEA"). The GDPR imposes mandatory data breach notification requirements subject to a 72-hour notification deadline. The GDPR also includes significant penalties for noncompliance, which may result in monetary penalties of up to the higher of €20.0 million or 4% of a group's worldwide turnover for the preceding financial year for the most serious violations. The GDPR and other similar regulations require companies to give specific types of notice and informed consent is required for the placement of a cookie or similar technologies on a user's device for online tracking for behavioral advertising and other purposes and for direct electronic marketing, and the GDPR also imposes additional conditions in order to satisfy such consent, such as a prohibition on pre-checked tick boxes and bundled consents. Enforcement of the GDPR and related regulations varies by each EU Member State and is ongoing. Further laws and regulations on these topics are forthcoming, including the Regulation on Privacy and Electronic Communications ("ePrivacy Regulation"), Digital Services Act ("DSA"), and Digital Markets Act ("DMA"). The GDPR may increase our responsibility and liability in relation to personal data that we process where that processing is subject to the GDPR. In addition, we may be required to put in place additional mechanisms to ensure compliance with the GDPR, including GDPR requirements as implemented by individual countries. Compliance with the GDPR will be a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices. In addition, under GDPR, transfers of personal data are prohibited to countries outside of the EEA that have not been determined by the European Commission to provide adequate protections for personal data, including the United States. There are mechanisms to permit the transfer of personal data from the EEA to the United States, but there is also uncertainty as to the future of such mechanisms, which have been under consistent scrutiny and challenge. In July 2020, a decision of the Court of Justice of the European Union invalidated the EU-U.S. Privacy Shield Framework, a means that previously permitted transfers of personal data from the EEA to companies in the United States that certified adherence to the Privacy Shield Framework. In July 2023, the European Union and the United States agreed to replace the Privacy Shield Framework by implementing the E.U.-U.S. Data Privacy Framework. Standard contractual clauses approved by the European Commission to permit transfers from the EU to third countries currently remain as a basis on which to transfer personal data from the EEA to other countries. However, the standard contractual clauses are also subject to legal challenge, and in November 2020, the European Commission published a draft of updated standard contractual clauses. In January 2022, for example, Austria's data protection authority determined that the use of Google Analytics violated the GDPR and the Court of Justice of the European Union's "Schrems II" decision on international data transfers. We presently rely on standard contractual clauses to transfer personal data from EEA member countries, and we may be impacted by changes in law as a result of future review or invalidation of, or changes to, this mechanism by European courts or regulators. While we will continue to undertake efforts to conform to current regulatory obligations and evolving best practices, we may be unsuccessful in conforming to permitted means of transferring personal data from the European Economic Area. We may also experience hesitancy,reluctance, or refusal by European or multi-national customers to continue to use some of our services due to the potential risk exposure of personal data transfers and the current data protection obligations imposed on them by certain data protection authorities. Such customers may also view any alternative approaches to the transfer of any personal data as being too costly, too burdensome, or otherwise objectionable, and therefore may decide not to do business with us if the transfer of personal data is a necessary requirement. Data protection requirements in China continued to change in 2023 and are expected change further in 2024. In 2023 new cross-border data transfer requirements came into force in China, and draft requirements for audit requirements for transborder data flows have been released, were not final at the end of 2023. Although we take reasonable efforts to comply with all applicable laws and regulations and have invested and continue to invest human and technology resources into data privacy compliance efforts, there can be no assurance that we will not be subject to regulatory action, including fines, in the event of an incident or other claim. Data protection laws and requirements may also be enacted, interpreted or applied in a manner that creates inconsistent or contradictory requirements on companies that operate across jurisdictions. We or our third-party service providers could be adversely affected if legislation or regulations are expanded to require changes in our or our third-party service providers' business practices or if governing jurisdictions interpret or implement their legislation or regulations in ways that negatively affect our or our third-party service providers' business, results of operations or financial condition. For example, we may find it necessary to establish alternative systems to maintain personal data in the EEA, which may involve substantial expense and may cause us to divert resources from other aspects of our business, all of which may adversely affect our results from operations. Further, any inability to adequately address privacy concerns in connection with our solutions, or comply with applicable privacy or data protection laws, regulations and policies, could result in additional cost and liability to us, and adversely affect our ability to offer our solutions. GDPR, CCPA and other similar laws and regulations, as well as any associated inquiries or investigations or any other government actions, may be costly to comply with, result in negative publicity, increase our operating costs, require significant management time and attention and subject us to remedies that may harm our business, including fines or demands or orders that we modify or cease existing business practices. Our systems may not be able to satisfy these changing requirements and manufacturer, retailer and associate expectations, or may require significant additional investments or time in order to do so. We expect that new industry standards, laws and regulations will continue to be proposed regarding privacy, data protection and information security in many jurisdictions, including the European e-Privacy Regulation, which is currently in draft form, as well as at the U.S. federal and state levels. In addition, new data processes and datasets associated with emerging technologies are coming under increased regulatory scrutiny, such as biometrics and automated decision-making. We cannot yet determine the impact such future laws, regulations and standards may have on our business. Complying with these evolving obligations is challenging, time consuming and expensive, and federal regulators, state attorneys general and plaintiff's attorneys have been, and will likely continue to be, active in this space. Expanding definitions and interpretations of what constitutes "personal data" (or the equivalent) within the United States, the EEA and elsewhere may increase our compliance costs and legal liability. For example, various state privacy proposals have included a private right of action for basic privacy violations which, if passed, would dramatically increase both the legal costs of defending frivolous lawsuits and the penalties and costs associated with alleged violations. Civil litigation, including class actions, remains another source of potential liability under privacy laws. For example, cases filed under Illinois' Biometric Information Privacy Act have resulted in large settlement amounts and damages awards against other companies due to the presence of statutory damages under that law. As another example, website owners and operators saw a wave of putative class actions filed against them in 2022 under the California Invasion of Privacy Act and similar federal and state surveillance and wiretapping laws, with claims centering on websites' deployment of session monitoring, keylogging, chatbots, and other tracking and monitoring technologies. The inconsistency among court rulings regarding these legal claims renders the likelihood and dollar amount of potential liability and/or settlement value difficult to accurately quantify. A data breach or any failure, or perceived failure, by us to comply with any federal, state or foreign privacy or consumer protection-related laws, regulations or other principles or orders to which we may be subject or other legal obligations relating to privacy or consumer protection could adversely affect our reputation, brand and business, and may result in fines, enforcement actions, sanctions, claims (including claims for damages by affected individuals), investigations, proceedings or actions against us by governmental entities or others, or other penalties or liabilities or require us to change our operations and/or cease using certain data sets, among other negative consequences, any of which could have a material adverse effect on our business. Moreover, the proliferation of supply chain-based cyber-attacks and vendor security incidents increases these potential risks and costs even in cases where the attack did not target us, occur on our systems, or result from any action or inaction by us. Depending on the nature of the information compromised, we may also have obligations to notify users, law enforcement, regulators, business partners or payment companies about the incident and provide some form of remedy, such as refunds or identity theft monitoring services, for the individuals affected by the incident.

Consolidation in the consumer goods and retail industries we serve could reduce aggregate demand for our services in the future and could adversely affect our business or our results of operations. When companies consolidate, the services they previously purchased separately are often purchased by the combined entity, leading to the termination of relationships with certain service providers or demands for reduced fees and commissions. The combined company may also choose to insource certain functions that were historically outsourced, resulting in the termination of existing relationships with third-party service providers. While we attempt to mitigate the revenue impact of any consolidation by maintaining existing or winning new service arrangements with the combined companies, there can be no assurance as to the degree to which we will be able to do so as consolidation continues in the industries we serve, and our business, financial condition or results of operations may be adversely affected.

Many of our clients seek opportunities to reduce their costs through procurement strategies that reduce fees paid to third-party service providers. As a result, certain of our clients have sought, and may continue to seek, more aggressive terms from us, including with respect to pricing and payment terms. Such activities put operational and financial pressure on our business, which could limit the amounts we earn or delay the timing of our cash receipts. Such activities may also cause disputes with our clients or negatively impact our relationships or financial results. Our clients have experienced, and may continue to experience, increases in their expenses associated with materials and logistics, which may cause them to reduce expenses elsewhere. While we attempt to mitigate negative implications to client relationships and the revenue impact of any pricing pressure by aligning our revenues opportunity with satisfactory client outcomes, there can be no assurance as to the degree to which we will be able to do so successfully. Additionally, price concessions can lead to margin compression, which in turn could adversely affect our business, financial condition or results of operations.

We have obtained licenses that give us rights to third party intellectual property that is necessary or useful to our business. These license agreements may impose various royalty and other obligations on us. One or more of our licensors may allege that we have breached our license agreement with them, and could seek to terminate our license, which could adversely affect our competitive business position and harm our business prospects. In addition, any claims brought against us by our licensors could be costly, time-consuming and divert the attention of our management and key personnel from our business operations.

We rely extensively on information systems and technology to manage our business and summarize operating results. We are in the process of a multi-year implementation of a new enterprise resource planning ("ERP") system. which is expected to replace our existing operating and financial systems. The ERP system implementation process has required, and will continue to require, the investment of significant personnel and financial resources. We may not be able to successfully implement the ERP system without experiencing delays, increased costs and other difficulties. If we are unable to successfully design and implement the new ERP system as planned, our financial positions, results of operations and cash flows could be negatively impacted. Additionally, if we do not effectively implement the ERP system as planned or the ERP system does not operate as intended, the effectiveness of our internal control over financial reporting could be adversely affected or our ability to assess those controls adequately could be further delayed.

Our ability to meet our workforce needs, while controlling associate-related costs, including salaries, wages and benefits, is subject to numerous external factors, including the availability of talented persons in the workforce in the local markets in which we operate, prevailing unemployment rates and competitive wage rates in such markets. We may find that there is an insufficient number of qualified individuals to fill our associate positions with the qualifications we seek. Competition in these communities for qualified staff could require us to pay higher wages and provide greater benefits, especially if there is significant improvement in regional or national economic conditions. We must also train and, in some circumstances, certify these associates under our policies and practices and any applicable legal requirements. If we are unable to hire, timely train or retain talented individuals we may face higher turnover and increased labor costs, which could compromise the quality of our service, and could adversely affect our business.

The consumer goods manufacturers and retailers to whom we provide our business solutions operate in highly competitive and rapidly changing environments. From time to time these parties may put their sales, retail, marketing and technology programs and relationships up for competitive review. We have occasionally lost accounts with significant clients as a result of these reviews in the past, and our clients are typically able to reduce or cancel current or future spending on our services on short notice for any reason. We believe that key competitive considerations for retaining existing and winning new accounts include our ability to develop solutions that meet the needs of these manufacturers and retailers in this environment, the quality and effectiveness of our services and our ability to operate efficiently. To the extent that we are not able to develop these solutions, maintain the quality and effectiveness of our services or operate efficiently, we may not be able to retain key clients, and our business, financial condition or results of operations may be adversely affected.

As a public company, we have incurred and will continue to incur significant legal, accounting, insurance, and other expenses that we did not incur as a private company, including costs associated with public company reporting requirements. We also have incurred and will incur costs associated with the Sarbanes-Oxley Act and related rules implemented by the SEC. The expenses incurred by public companies for reporting and corporate governance purposes generally have been increasing. Laws and regulations could also make it more difficult or costly for us to obtain certain types of insurance, including director and officer liability insurance, and we may be forced to accept reduced policy limits and coverage or incur substantially higher costs to obtain the same or similar coverage. These laws and regulations could also make it more difficult for us to attract and retain qualified persons to serve on our board of directors, on our board committees, or as our executive officers. Furthermore, if we are unable to satisfy our obligations as a public company, we could be subject to delisting of our Class A common stock, fines, sanctions, and other regulatory action and potentially civil litigation.

The COVID-19 pandemic, including the measures taken to mitigate its spread, had, and may continue to have, adverse effects on our business and operations. A resurgence of the COVID-19 pandemic, or a future pandemic or health epidemic, could adversely impact our business and results of operations in a number of ways . For example, the COVID-19 pandemic and measures taken to mitigate the spread of COVID-19, including restrictions on large gatherings, closures of face-to-face events and indoor dining facilities, "shelter in place" health orders and travel restrictions, had far-reaching direct and indirect impacts on many aspects of our operations, including temporary termination of certain in-store demonstration services and other services, as well as on consumer behavior and purchasing patterns. In particular, our marketing segment experienced a significant decline in revenues, primarily due to the temporary suspension or reduction of certain in-store demonstration services and decreased demand in our digital marketing services, both of which we believe were caused by the COVID-19 pandemic and the various governmental and private responses to the pandemic. In our sales segment, we experienced significant shifts in consumer spending preferences and habits. We cannot predict the full extent to which a resurgence of the COVID-19 pandemic, or any future pandemic or health epidemic, may have similar or other adverse effects on our business, financial condition, results of operations and liquidity, and the degree to which it may impact other risk factors described in this Annual Report.