Advantage Solutions (ADV) Risk Analysis

Our five largest clients generated approximately 22% of our revenues, none of which individually generated more than 10%, in the fiscal year ended December 31, 2025. These clients are generally able to reduce or cancel spending on our services on short notice for any reason. A significant reduction in spending on our services by our largest clients, or the loss of one or more of our largest clients, if not replaced by new clients or an increase in business from existing clients, would adversely affect our business and results of operations. In addition, when large retailers suspend or reduce in-store demonstration services, such as in response to pandemic, our business and results of operations can be adversely affected.

Our ability to acquire new clients and to retain existing clients, whether by expansion of our own operations or through an acquired business may in some cases be limited by the other parties' perceptions of, or policies concerning, perceived competitive conflicts arising from our other relationships. Some of our contracts expressly restrict our ability to represent competitors of the counterparty. These perceived competitive conflicts may also become more challenging to avoid or manage as a result of continued consolidation in the CPG and retail industries and our own acquisitions. If we are unable to avoid or manage business conflicts among competing manufacturers and retailers, we may be unable to acquire new clients or be forced to terminate existing client relationships, and in either case, our business and results of operations may be adversely affected.

We have obtained licenses that give us rights to third party intellectual property that is necessary or useful to our business. These license agreements may impose various royalty and other obligations on us. One or more of our licensors may allege that we have breached our license agreement with them, and could seek to terminate our license, which could adversely affect our competitive business position and harm our business prospects. In addition, any claims brought against us by our licensors could be costly, time-consuming and divert the attention of our management and key personnel from our business operations.

Changes to practices and policies of operating systems, websites and other digital platforms, including, without limitation, Apple's or Android's transparency policies, may reduce the quantity and quality of the data and metrics that can be collected or used by us and our clients or reduce the value of our digital services. These limitations may adversely affect both our and our clients' ability to effectively target and measure the performance of our digital services. In addition, our clients and third-party vendors routinely evaluate their digital practices and policies, and if in the future they determine to modify such practices and policies for any reasons, including, without limitation, privacy, targeting, age or content concerns, this could decrease the desire for our digital services as compared to other alternatives. If we are unable to timely or effectively respond to changes in digital practices and policies, or if our clients do not believe that our digital services will generate a competitive return on investment relative to alternatives, then our business, financial condition or results of operations could be adversely affected.

We believe that our continued success depends to a significant extent upon the efforts, abilities and relationships of our senior executives and the strength of our middle management team. Although we have entered into employment agreements with certain of our senior executives, each of them may terminate their employment with us at any time. The replacement of any of our senior executives likely would involve significant time and costs and may significantly delay or prevent the achievement of our business objectives and could therefore have an adverse impact on our business. In addition, we do not carry any "key person" insurance policies that could offset potential loss of service under applicable circumstances. Furthermore, if we are unable to attract and retain a talented team of middle management executives, it may be difficult to maintain the expertise and industry relationships that our clients value, and they may terminate or reduce their relationship with us.

We have outsourced certain business processes in the areas of logistics, supply chain, certain financial service functions and information technology and security to third-party service providers. We have also engaged third parties to host and manage certain aspects of our information and technology infrastructure to provide certain back-office support activities, and to support business process outsourcing for our clients. Outsourcing these functions involves the risk that third-party service providers may not perform to our standards or legal requirements, may not produce reliable results, may not perform in a timely manner, may not maintain the confidentiality of our proprietary information, or may fail to perform at all. Failure by these third parties to meet their contractual, legal and other obligations to us, or our failure to adequately monitor their performance, could result in our inability to achieve the expected cost savings or efficiencies and could result in additional costs to correct errors made by such service providers or could result in the imposition by governmental authorities of procedures or penalties. Additionally, if any of our relationships with these third-party service providers were terminated, or if any of these parties were to cease doing business or supporting the applications and services we currently utilize, our business could be disrupted, and we may be forced to spend significant time and money to change vendors or insource these aspects of our business. We also have diminished control over the quality and timeliness of the outsourced services, including the cybersecurity protections implemented by these third parties. As a result of these outsourcing arrangements, we may experience interruptions or delays in our processes, loss or theft of sensitive data or other cybersecurity issues, compliance issues, challenges in maintaining and reporting financial and operational information, and increased costs to remediate any unanticipated issues that arise, any of which could materially and adversely affect our business, financial condition and results of operations. Additionally, any disruptions such as recently announced tariffs, a government shutdown, war, natural disaster or global pandemic, could affect the ability of our third-party service providers to meet their contractual obligations to us. Failure of these third parties to meet their contractual, regulatory, confidentiality or other obligations to us could result in material financial loss, higher costs, regulatory actions, and reputational harm.

Our business is subject to various, and sometimes complex, laws and regulations. In order to conduct our operations in compliance with these laws and regulations, we must obtain and maintain numerous permits, approvals and certificates from various federal, state, local and international governmental authorities. We may incur substantial costs in order to maintain compliance with these existing laws and regulations. In addition, our costs of compliance may increase if existing laws and regulations are revised or reinterpreted or if new laws and regulations become applicable to our operations. These costs could have an adverse impact on our business or results of operations. Moreover, our failure to comply with these laws and regulations, as interpreted and enforced, could lead to fines, penalties or management distraction or otherwise harm our business.

We are subject to litigation and regulatory proceedings in the normal course of business and could become subject to additional claims in the future. These proceedings have included, and in the future may include, matters involving personnel and employment issues, workers' compensation, personal and property injury, disputes relating to acquisitions (including contingent consideration), governmental investigations and other proceedings. Some historical and current legal proceedings and future legal proceedings may purport to be brought as class actions or representative basis on behalf of similarly situated parties including with respect to employment-related matters. We cannot be certain of the ultimate outcomes of any such claims, and resolution of these types of matters against us may result in significant fines, judgments or settlements, which, if uninsured, or if the fines, judgments and settlements exceed insured levels, could adversely affect our business or financial results. See "Legal Proceedings."

A variety of federal, state, and foreign laws and regulations govern the collection, use, retention, sharing, and security of personal information. The requirements imposed by such laws and regulations relating to privacy and data protection are increasingly demanding, quickly evolving, and may be subject to differing interpretations. Further, given their patchwork status, these requirements often cannot be harmonized and may be applied in a manner that is inconsistent from one jurisdiction to another. As a result, our practices may not have complied or may not comply in the future with all such laws, regulations, requirements, and obligations. Our actual or perceived failure to comply with such laws and regulations could result in fines, investigations, enforcement actions, penalties, sanctions, claims for damages by affected individuals, and damage to our reputation, among other negative consequences, any of which could have a material adverse effect on its financial performance. We and certain of our third-party providers collect, maintain and process data about consumer, employees, business partners and others, including personally identifiable information, as well as proprietary information belonging to our business such as trade secrets (collectively, "Confidential Information"). Our business model does not require a significant amount of consumer personal information to sustain operations or create additional business opportunities. The largest area of privacy exposure relates to the collection and use of personal information of our employees. As such, we are subject to the California Consumer Protection Act of 2018, as well as its amendment, the California Privacy Rights Act of 2020 (the "CPRA") and accompanying regulations, the California Consumer Privacy Act Regulations (collectively, the "CCPA"). The CCPA regulates the collection, use, and processing of personal information relating to California residents, which includes our employees. It grants certain privacy rights to California residents, including the right to access, correct, and delete personal information relating to such individuals under certain circumstances. Compliance with obligations imposed by the CCPA depends in part on how its requirements are interpreted and applied by the California attorney general, courts, and the California Privacy Protection Agency. In 2026, violations of the CCPA may result in substantial civil penalties or statutory damages of approximately $2,700 per violation or approximately $8,000 per intentional violation of any CCPA requirement, which may be applied on a per-person or per-record basis. The CCPA also establishes a private right of action if certain personal information of individuals is breached as a result of a business's violation of the duty to implement and maintain reasonable security procedures and practices. This violation authorizes statutory damages of approximately $100 to $800 per person per incident even if there is no actual harm or damage to plaintiffs. This private right of action may increase the likelihood of, and risks associated with, general data breach litigation. By the end of 2026, laws similar to CCPA are expected to be in effect in 18 states, and this number may increase as 14 additional states have active legislation under consideration. Like the CCPA, these laws regulate the collection, use and processing of personal information relating to residents of the respective states, and grants certain privacy rights to those residents. Similarly, the U.S. Federal Trade Commission continues to actively investigate and enforce privacy violations by its authority under the FTC Act Section 5, with recent enforcement actions focusing on various types of personal data that the FTC considers to be sensitive. As with the state privacy laws discussed above, however, this authority generally does not extend to employment-related uses of personal information. We may also, but on a much more limited extent, be subject to international privacy laws and regulations, such as the General Data Privacy Regulation in the European Union, Canada's Personal Information Protection and Electronic Documents Act, and other related privacy laws in the countries where we have employees or obtain third party services. While these laws are generally more stringent than those currently enforced in the United States, we have very limited operations in international jurisdictions, and none of those operations are customer-facing, thus further reducing our risk. However, we continue to comply with all applicable laws in these international locations, with specific assurance that we are meeting all requirements concerning the protection and use of employee personal information. Although we make reasonable efforts to comply with all applicable laws and regulations and have invested and continue to invest human and technological resources into data privacy compliance efforts, there can be no assurance that we will not be subject to regulatory action, including fines, in the event of an incident or other claim. We, or our third-party service providers, could be adversely affected if legislation or regulations are expanded or interpreted to require changes to business practices. Further, any inability to adequately address privacy concerns in connection with our solutions, or comply with applicable privacy or data protection laws, regulations, and policies, could result in additional cost and liability to us, and adversely affect our ability to offer our solutions. Privacy laws and regulations, as well as any associated inquiries or investigations or any other government actions, may be costly to comply with, result in negative publicity, increase our operating costs, require significant management time and attention, and subject us to remedies that may harm our business, including fines, or demands or orders that we modify or cease existing business practices, including data deletion and algorithmic disgorgement. We expect that new industry standards, laws, and regulations will continue to be proposed regarding privacy, data protection, and information security in many jurisdictions. Specifically, data processing associated with emerging technologies, and data sets utilizing sensitive personal information, are coming under increased regulatory scrutiny, such as those related to biometrics, AI, and automated decision-making. These evolutionary areas of privacy concern may create additional requirements for compliance, including privacy impact assessments, which aim to have companies document the risks associated with the processing of high-risk data are now essential but create additional work. We also suspect that compliance with AI-related legal obligations will be our greatest challenge, as we continue to stretch our business and operating models to utilize AI to increase efficiency and reduce workload strain. Such obligations may include modified and expanded governance programs, outcome-based testing, pre-use notices, end user rights such as access and opt-out rights, human monitoring, and intervention controls, and regulatory reporting. Ongoing monitoring of these laws and compliance with their evolving requirements will be challenging, time consuming, and expensive, and federal regulators, state attorneys general, and plaintiff's attorneys have been, and will likely continue to be, active in this space. Additionally, nuanced legal arguments related to consumer protection online, continue to require awareness. Specifically, the selling and sharing of personal information by businesses for digital advertising and marketing purposes remains a priority of regulators, including the FTC and California Attorney General. Further, recent years have seen a dramatic proliferation of plaintiff's attorney-driven class action litigation, individual litigation, arbitrations, and demand letters related to Internet-based technologies such as website cookies and pixels, tracking technologies, chatbots, and AI tools, and there is little sign that this trend will abate in the near-term. To the contrary, we expect both regulators and plaintiff's attorneys to continue to seek to apply these legal theories to an ever-expanding list of technologies and data processing activities. Collectively, this stresses the importance of proper cataloging of websites and a governance structure for the deployment of third party technologies, including cookies, pixels, and other tracking technologies, by business teams and third parties. Relatedly, website owners and operators have seen a wave of putative class actions, individual civil actions, single and mass arbitration demands, and demand letters filed against them in recent years, under the California Invasion of Privacy Act and similar federal and state surveillance and wiretapping laws, with claims centering on companies' deployment of web- and app-based tracking technologies (including cookies, pixels, scripts, and software development kits), session monitoring, key logging, chatbots, and other tracking and monitoring technologies. These legal claims, based on the reemergence of old laws retrofitted for a modern society, create novel issues of law and fact that may require extended litigation to resolve, as inconsistency among court rulings, rendering the likelihood and dollar amount of potential liability and/or settlement value difficult to accurately quantify. In sum, a data breach or any failure to comply with any applicable privacy or consumer protection-related laws, regulations, or other principles could adversely affect our reputation, brand, and business, and may result in fines, enforcement actions, sanctions, claims (including claims for damages by affected individuals), investigations, proceedings, or actions against us by governmental entities or others. This could have a material adverse effect on our business as we spend time tending to these issues and/or are forced to change our operations. Moreover, the proliferation of vendor security incidents increases these potential risks and costs even in cases where the attack did not target us, occur on our IT Systems, or result from any action or inaction by us. Depending on the nature of the information compromised, we may also have obligations to notify users, law enforcement, regulators, business partners or payment companies about the incident and provide some form of remedy, such as refunds or identity theft monitoring services, for the individuals affected by the incident.

The COVID-19 pandemic, including the measures taken to mitigate its spread, had adverse effects on our business and operations. A future pandemic or health epidemic, could adversely impact our business and results of operations in a number of ways. For example, the COVID-19 pandemic and measures taken to mitigate the spread of COVID-19 had far-reaching direct and indirect impacts on many aspects of our operations, including termination of in-store demonstration services and certain other services, as well as on consumer behavior and purchasing patterns. In particular, our Experiential Services segment experienced a significant decline in revenues, primarily due to the temporary suspension or reduction of certain in-store demonstration services and decreased demand in our digital marketing services, both of which we believe were caused by the COVID-19 pandemic and the various governmental and private responses to the pandemic. We cannot predict the full extent to which a future pandemic or health epidemic, may have similar or other adverse effects on our business, financial condition, results of operations and liquidity, and the degree to which it may impact other risk factors described in this Annual Report.