Our business is conducted through the internet and therefore, among other things, we are subject to the laws and regulations that apply to e-commerce and online businesses around the world. These laws and regulations are becoming more prevalent in the United States, Europe, Israel, Canada and elsewhere and may impede the growth of the internet and consequently our services. These regulations and laws may cover privacy, data collection and protection, location of data storage and processing, cybersecurity, e-commerce, content, use of “cookies,” access changes, “net neutrality,” pricing, advertising, distribution of “spam,” copyright and other intellectual property, libel, marketing, distribution of products, protection of minors, consumer protection, taxation and online payment services. Many areas of the law affecting the internet remain largely unsettled, even in areas where there has been some legislative action. For example, we collect, use, maintain and otherwise process certain data about our customers (including, without limitation, customers’ clients or users), partners, employees, consultants, leads and consumers. Our ability to collect, use, maintain or otherwise process personal data has been, and could be further, restricted by existing and new laws and regulations relating to privacy and data collection and protection, including the EU General Data Protection Regulation (the “GDPR”). These laws and regulations define personal data to include location data and online identifiers, which are commonly used and collected parameters in digital advertising and, among other things, impose stringent user consent requirements and permit data subjects to request we discontinue using certain data. In addition, some countries are considering or have enacted legislation requiring local storage and processing of data that could increase the cost and complexity of delivering our services. Additionally, the uncertainty created by these laws and regulations can be compounded when services hosted in one jurisdiction are directed at users in another jurisdiction. For instance, European data protection rules may apply to companies which are not established in the European Union (“EU”). The GDPR has an even wider territorial scope and contains significant penalties for non-compliance. The GDPR, among other things, imposes requirements to provide detailed and transparent disclosures about how personal data is collected and processed, grants rights for data subjects to access, delete or object to the processing of their personal data, provides for a mandatory breach notification to supervisory authorities (and in certain cases, affected individuals) of certain data breaches, sets limitations on the retention of personal data and outlines significant documentary requirements to demonstrate compliance through policies, procedures, training and audits. To further complicate matters in Europe, to date, supervisory authorities in the member states have some flexibility when implementing European Directives and certain aspects of the GDPR, which can lead to diverging national rules. European supervisory authorities have been very active in terms of enforcing data protection rules, including with respect to cookie-related matters. The withdrawal of the United Kingdom (“U.K.”) from the EU (“Brexit”) also has created uncertainty with regard to the regulation of data protection in the United Kingdom. Since January 1 2021, when the transitional period following Brexit expired, we have been required to comply with the GDPR as well as the U.K.’s General Data Protection Regulation (“U.K. GDPR”) (combining the GDPR and the UK’s Data Protection Act of 2018), which exposes us to two parallel regimes, each of which authorizes similar fines and may subject us to increased compliance risk based on differing, and potentially inconsistent or conflicting, interpretation and enforcement by regulators and authorities (particularly, if the laws are amended in the future in divergent ways). With respect to transfers of personal data from the European Economic Area (“EEA”), on June 28, 2021, the European Commission issued an adequacy decision in respect of the U.K.’s data protection framework, enabling data transfers from EU member states to the U.K. to continue without requiring organizations to put in place contractual or other measures in order to lawfully transfer personal data between the territories. While it is intended to last for at least four years, the European Commission may unilaterally revoke the adequacy decision at any point, and if this occurs, it could lead to additional costs and increase our overall risk exposure. Additionally, the European Commission is currently re-examining its Decision 2011/61/EU regarding the adequacy of Israeli law, in light of the GDPR and developments in Israeli privacy legislation, which could result in revoking Israel’s adequacy status for purposes of transfers of personal data from the EEA to Israel. The outcome of this examination may also affect the U.K.’s approach on the adequacy of Israeli law with respect to the U.K. GDPR, which could require us to further review and amend the lawful mechanisms by which we make and/or receive personal data transfers from the U.K. It is unclear how U.K. data protection laws or regulations will develop in the medium to longer term. Additionally, recent legal developments in Europe have created complexity and uncertainty regarding transfers of personal data from the EEA to the United States. Most recently, on July 16, 2020, in a case known as Schrems II, the Court of Justice of the European Union (“CJEU”) invalidated the EU-US Privacy Shield Framework (“Privacy Shield”), under which personal data could be transferred from the EEA to U.S. entities which had self-certified under the Privacy Shield scheme. While the CJEU upheld the adequacy of the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, and potential alternative to the Privacy Shield) (“SCCs”), it made clear that reliance on SCCs alone may not necessarily be sufficient in all circumstances. The CJEU's decision also cast doubt over the effectiveness of the SCCs. The European Data Protection Board, which subsequently issued a revised set of SCCs for organizations to utilize, released their comments on the supplementary measures that can be used to ensure a sufficient level of data protection when transferring personal data. The comments indicated that organizations need to perform a data transfer impact assessment to evaluate the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals, and that additional measures and/or contractual provisions may need to be put in place. However, the nature of these additional measures is currently uncertain. Comparable risks and considerations apply with respect to transfers of personal data from the U.K. to the United States. Similarly, there have been laws and regulations adopted throughout the United States and in Israel that impose new obligations in areas such as privacy, in particular protection of personal information and implementing adequate cybersecurity measures to protect such information. In the United States, both federal and state legislation also govern the collection, use and other processing of personal data, and the advertising industry has been subject to review by the Federal Trade Commission (the “FTC”), U.S. Congress, and individual states. For example, the California Consumer Privacy Act (“CCPA”), provides data privacy rights for California residents and operational requirements for covered companies. Among other things, companies covered by the CCPA must provide new disclosures to California residents and afford such residents the ability to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. In addition to the CCPA, the California Privacy Rights Act (“CPRA”), which passed in November 2020 and will take effect in January 2023, will expand the rights granted under the CCPA and impose additional notice and opt out-obligations, including an obligation to provide California residents with the ability to opt-out to the processing of personal information for purposes of behavioral advertising. Additional U.S. states have implemented, or are in the process of implementing, similar new laws or regulation (for example, the Virginia Consumer Data Protection Act (“VCDPA”) that will go into effect on January 1, 2023 and the Colorado Privacy Act (“CPA”) which will go into effect on July 1, 2023) that impose new privacy rights and obligations. Further, laws in all 50 states require businesses to provide notice to consumers whose personal information has been disclosed as a result of a data breach. More generally, some observers have noted that the CCPA, CPRA, VCDPA, and CPA could mark the beginning of a trend toward more stringent United States federal privacy legislation, which could increase our potential liability and adversely affect our business. The CCPA, and eventually the CPRA, VCDPA, CPA, and other legal and regulatory changes, are making it easier for certain individuals to opt-out of having their personal data processed and disclosed to third parties through various opt-out mechanisms, which could result in an increase to our operational costs to ensure compliance with such legal and regulatory changes. In recent years, there has also been an increase in attention to and regulation of privacy and data collection and protection across the globe, including in the United States with the increasingly active approach of the FTC to enforcing data privacy under the Section 5 of the FTC Act pursuant to the “Unfair and Deceptive Acts and Practices” framework. Similar to the GDPR, the CCPA, and eventually the CPRA, VCDPA, CPA, and other legal and regulatory changes, will require us to devote resources and incur additional costs associated with compliance, as well as impose additional restrictions on our and our partners’ operations. In addition, failure to comply with the Israeli Privacy Protection Law 1981 and its regulations, as well as the guidelines of the Israeli Privacy Protection Authority, may expose us to administrative fines, civil claims (including class actions) and, in certain cases, criminal liability. Current pending legislation may result in a change to the current enforcement measures and sanctions. There have also been privacy bills enacted in other countries around the world, such as Brazil, which have introduced new or expanded privacy requirements and we expect that privacy legislation will continue to evolve in the coming years. Therefore, it is difficult to determine whether and how such existing and laws and regulations will apply to and impact the internet and our business. Further, any failure or perceived failure to comply with our public privacy policies and other public statements about privacy and cybersecurity could potentially subject us to regulatory investigations, enforcement or legal actions, and harm to our reputation and, if such policies or statements are found to be deceptive, unfair or misrepresentative of our actual practices, fines, monetary or other penalties, and other damage to our business and results and results of operations. Although we strive to comply with applicable laws and regulations the evolving global standards regarding privacy and to inform our customers of our business practices prior to any installations of our product and use of our services, it is possible that these laws may be interpreted and applied in a manner that is inconsistent with our data collection, use, preservation and other processing practices or that it may be argued that our practices do not comply with certain countries’ privacy and data collection and protection laws and regulations. Due to rapid changes in technology and the inconsistent interpretations of privacy and data collection and protection laws and regulations, we may be required to materially change the way we do business. The challenges imposed by the ongoing need to remain compliant with such laws and regulations, as well the need to implement any changes required based on newly introduced laws and regulations, may slow our growth, and if we are not able to cope with these challenges as effectively as other companies, we will be competitively disadvantaged. Any limitation on our ability to collect and utilize data, including personal data, would make it more difficult for us to be able to optimize ad placement for the benefit of our advertisers and publishers, which could render our solutions less valuable and potentially result in loss of clients and a decline in revenue. For example, we may need to adapt our advertising solution to a “cookie-less” environment and introduce alternative solutions which may not provide the targeting capabilities provided by cookies. In addition, we may be required to implement physical, administrative and technological security measures that differ from those we have now, such as different data access controls or encryption technology. Further, we use cloud-based computing, which is not without substantial risk, particularly at a time when businesses of almost every kind are finding themselves subject to an ever-expanding range of privacy, data collection and processing and cybersecurity laws and regulations, document retention requirements, and other standards of accountability. Compliance with such existing and new laws and regulations can be costly and can delay, or impede the development of new products, any and failure or perceived failure to comply with such laws and regulations could result in negative publicity, increase our operating costs, require significant management time and attention and subject us to inquiries or investigations, litigation (including class actions), claims, or other remedies, including penalties, fines, sanctions and criminal and civil liabilities, or demands or orders that we modify or cease existing business practices, each of which could materially affect our operating results and our business. Moreover, concerns about our collection, use, sharing, handling and other processing of data or other privacy related matters, even if unfounded, could harm our reputation and operating results. For more information regarding government regulations to which we are subject, see Item 4.B. “Business Overview— Government Regulation.”